Goblin Gate
OverviewFeaturesTourRoadmap
Beta 8 · Open source (GPLv3)

Goblin Gate

A goblin guards your front door, and you can watch everything it does. The firewall for people who want to understand and automate their network: enterprise features, homelab price, nothing hidden.

Debian, nftables, Suricata, Unbound and Kea underneath. A modern web UI, a REST API for everything, a CLI, signed updates that undo themselves, and sandboxed plugins. Runs on your own x86-64 box or a VM.

Deploy a goblin Try the demo Take the tour
Goblin Gate's firewall policy table: ordered policies with source, destination, service, accept or deny, NAT and security profile badges

Status: the last beta. Everything planned for 0.1.0 is in, the core features pass automated end-to-end tests on real VMs, and there are no new features until 0.1.0: from here on it's about fixing what you find. Try it in a VM or on a spare box first, keep your old firewall's config at hand while you switch, and tell the goblin about anything odd.

Why another firewall?

Win on design, not just release pace

For homelabbers, self-hosters, tinkerers, students learning networking, and small offices that want enterprise features without enterprise licensing.

Security profiles per policy

Build an IPS, web filter, DNS filter or app control profile once, attach it to any policy. The kids' Wi-Fi and your lab VLAN can play by different rules.

Config you can trust

Stage changes, see the diff, commit. If a change locks you out, it reverts itself. Every commit is a revision you can roll back to, and can land in your own git repository too (secrets left out).

API-first

The web UI, the CLI and your scripts all go through the same REST API. Whatever you can click, you can automate.

Built on Linux

Current hardware drivers, native WireGuard and Tailscale, on a Debian base every homelabber already knows.

Updates that undo themselves

Signed packages in a stable and a beta channel. If an update doesn't come back healthy within 5 minutes, the box reinstalls the previous version on its own.

Easy on the eyes

Dashboards you build from widgets, a log viewer with drill-down, a chart builder, light and dark themes, and a layout that works on a phone.

Made for humans

A firewall that helps you get it right

Most firewall trouble isn't an exotic attack. It's an admin page left open, a port forward open to the whole internet, or a backup nobody made. The goblin looks for those.

Goblin Checks: a score of 89 with two findings, each with Fix it and Dismiss buttons
Goblin Checks audits your own setup: admin pages open to the internet, port forwards open to everyone, admins without two-factor login, no backup off the box. Each finding says why it matters, with a "Fix it" button.
Templates: guest network, IoT network, port forward for some places only, network through a VPN provider, bedtime for some devices
Templates for the setups everyone builds: a guest network, an IoT network, "my game server, but only from home", a VLAN through a VPN provider, a bedtime for the kids' tablets. Answer a few questions, preview, commit.
Try it without installing

Click around before you commit

The demo, on your own computer

The real web UI on a pretend home network with made-up traffic. Click anything, commit, roll back, break it. Nothing reaches your network, and it's gone when you stop it.

Needs Docker (Windows, Mac or Linux). The download is about 10 MB.

One command

docker run --rm -p 127.0.0.1:8090:8090 ghcr.io/mostlywithinspec/goblin-gate-demo

Then open localhost:8090. Ctrl+C stops it and nothing is left behind.

Explore

Dig deeper

Features

Everything in 0.1.0, from policies and IPS to UPS support, plus Goblin Sentry and plugins.

Tour

Screenshots of the web UI, in dark and light.

Roadmap

What each release added, what's happening now, and where the goblin is headed.

Deploy a goblin

What hardware you need and how to install it, step by step.

User guide

The wiki: every page of the web UI, recipes and troubleshooting.

Free core, open source

GPLv3. The core firewall stays free; optional extras may come one day, but never by moving core features behind a paywall. No box to buy: any x86-64 PC or a VM.