v2.4 — Graphite UI · English & German · Language switch

Your firewall.
Your rules.
No surprises.

nftables through a web interface that cannot lock you out: every apply reverts itself unless you confirm it.

Go 1.25 · GPL-3.0 · nftables via netlink · Argon2id auth

The easywall dashboard: firewall status with acceptance state, pending changes and last apply; tiles counting TCP ports, UDP ports, blacklist, whitelist, custom rules and forwarding; and a recent-activity list. — The dashboard answers one question first: what is this firewall enforcing right now?

The idea

A firewall you edit over the network can lock you out of the machine you are editing it on. easywall makes that recoverable by default.

State machine: editing leads to Staged, applying leads to Live, confirming within the window leads to Confirmed, and letting the window expire leads to Rolled back, from where the staged edits are still available.

Editing changes nothing. Applying changes everything — for 120 seconds. If the new rules cut your connection you cannot click Confirm, and not confirming is what brings the old rules back.

What it is made of


Two processes	the web interface runs unprivileged and has no path to the kernel
netlink, not a shell	rules are Go structs, so there is no command line to inject into
Three rule sets	Staged, Current, Backup — editing and enforcing are separate
Audit log	every change records who, what and when
Coexists with Docker	easywall owns `table inet easywall` and touches nothing else
English and German	switchable in the interface, including before you sign in

How it works →

The order rules are evaluated

The one thing worth knowing before you write a rule. A whitelisted address reaches every port; a blacklisted one is dropped before the whitelist is ever consulted.

Decision flow for an incoming packet: loopback, established connections and ICMP first, then protection modules, then Docker bridge networks, then the blacklist which drops, then the whitelist which accepts every port, then open ports, then custom rules, and finally the chain policy which drops.

Where to start

You want to	Go to
Try it without installing anything	Live demo ↗ · Demo mode
Install on Debian or Ubuntu	.deb package
Run it in a container	Docker
Build from source	Manual install
Understand the design	Architecture · Security

Try it before you install it

A full interface running against an in-memory mock. Nothing reaches a real firewall.

Open the demo ↗ Requirements

Your firewall. Your rules. No surprises.