Manual Installation

For distributions without a package. Check Requirements first.

Build

Go 1.25+ on the build machine — not on the target.

git clone https://github.com/jp1337/easywall.git
cd easywall
make build          # produces bin/easywall-core and bin/easywall-web

The version from git describe is embedded at build time. Cross-compiling works the usual way:

GOOS=linux GOARCH=arm64 CGO_ENABLED=0 make build

Install

sudo make install

That places the binaries in /usr/sbin, the assets in /usr/share/easywall, and both systemd units in /lib/systemd/system. It does not create the service user, the directories or the config — do that once:

sudo groupadd --system easywall 2>/dev/null || true
sudo useradd  --system --no-create-home --shell /usr/sbin/nologin \
              --gid easywall easywall 2>/dev/null || true

sudo install -d -m 0750 -o root     -g easywall /run/easywall
sudo install -d -m 0750 -o root     -g root     /etc/easywall /etc/easywall/ssl
sudo install -d -m 0750 -o easywall -g easywall /var/lib/easywall
sudo install -d -m 0750 -o root     -g easywall /var/log/easywall

sudo cp config/easywall.toml /etc/easywall/

Configure

One secret is needed — the key that signs session cookies:

sudo tee /etc/easywall/web.toml > /dev/null <<EOF
bind_addr   = "0.0.0.0:12227"
socket_path = "/run/easywall/core.sock"
ssl_dir     = "/etc/easywall/ssl"
data_dir    = "/var/lib/easywall"
language    = "en"
session_key = "$(openssl rand -hex 32)"
username    = ""
password    = ""
[tls]
cert = ""
key  = ""
EOF

sudo chown root:easywall /etc/easywall/web.toml /etc/easywall/easywall.toml
sudo chmod 0640          /etc/easywall/web.toml /etc/easywall/easywall.toml

No csrf_key is needed. CSRF protection is Go 1.25’s net/http.CrossOriginProtection, which checks Origin and Sec-Fetch-Site instead of issuing tokens. The key that older configs and older versions of this page asked for is not read by anything.

Start

sudo systemctl enable --now easywall-core easywall-web
systemctl status easywall-core easywall-web     # both should be active (running)

Open https://<server>:12227, accept the self-signed certificate, and complete the setup wizard.

Uninstall

sudo systemctl disable --now easywall-core easywall-web
sudo rm -f /lib/systemd/system/easywall-core.service \
           /lib/systemd/system/easywall-web.service
sudo systemctl daemon-reload

sudo rm -f  /usr/sbin/easywall-core /usr/sbin/easywall-web
sudo rm -rf /usr/share/easywall

# the rules stay in the kernel until you say otherwise
sudo nft delete table inet easywall 2>/dev/null || true

# config, rules and logs — back them up first if you want them
sudo rm -rf /etc/easywall /var/lib/easywall /var/log/easywall
sudo userdel  easywall 2>/dev/null || true
sudo groupdel easywall 2>/dev/null || true