Everything in 0.1.0
All of it free and open source, all of it behind the same REST API.
Firewall
Interfaces and VLANs, address and service objects, ordered policies (first match wins, everything else is denied), NAT, port forwards limited to the sources you pick, schedules, country rules (GeoIP), your own nftables rules for what policies can't express, and UPnP / NAT-PMP if you want it (off by default).
Security profiles
IPS, web filter, DNS filter and application control profiles, built once and attached to any policy. Presets from Off to Strict.
Threat protection
Intrusion prevention (Suricata inline, ET Open rules or ET Pro with a subscription), threat feeds kept fresh automatically, a CrowdSec bouncer, temporary blocks that lift themselves, and DNS and web filters that also close the usual DNS-over-HTTPS and private-relay side doors.
Routing
IPv6 with DHCPv6 prefix delegation and router advertisements, multi-WAN with health checks, failover and load sharing, static routes, a gateway per policy, and smart queue (CAKE) so games and calls stay smooth while someone fills the line.
Network services
DHCP (Kea) and a DNS resolver (Unbound) with local names for DHCP clients, split DNS and DNS rebinding protection, dynamic DNS (Cloudflare, DuckDNS or any update URL), and Wake-on-LAN.
VPN
WireGuard with a QR code per phone or laptop, Tailscale, and VPN providers as gateways with a kill switch.
Goblin Checks and templates
An audit of your own setup with a score, most important first, each finding explained and linked to its fix. Templates for a guest network, an IoT network, a limited port forward, a VLAN through a VPN provider, and a bedtime for some devices.
Ask before you break it
A policy simulator ("would this reach that?"), a "why was this denied?" button in the log, the generated config files to read, snapshots to experiment with, and commit with automatic rollback.
Visibility
Dashboards from widgets, Log & Report with drill-down, a chart builder, a device inventory, live traffic per device, packet capture in the browser, and ping, traceroute and DNS lookups from the box.
Plays well with others
Prometheus metrics with a ready Grafana dashboard, logs sent on to syslog or Grafana Loki, config history pushed to your own GitHub or Gitea repository, a live event stream, and notifications by email, webhook, Discord, ntfy or Telegram.
Three ways in, one config
A web UI (light and dark, phone-friendly, with global search), a REST API for everything with API tokens limited to what a script needs, and a CLI. They all edit the same candidate config.
Hardened by default
Two-factor login, active sessions you can end, anti-spoofing, nightly Debian security updates, every service in its own sandbox, and a security audit behind beta 8.
Power cuts
UPS support, on the box's USB port or one your NAS already watches: an alert when the power goes, a clean shutdown before the battery runs out.
Updates
Signed packages in a stable and a beta channel. If an update doesn't come back healthy within 5 minutes, the box quietly reinstalls the previous version.
Moving in
Import your old firewall's XML backup: a report lists every item as converted, approximated or skipped, and nothing goes live until you commit.
Installs anywhere
An offline installer ISO for bare metal (BIOS or UEFI, Secure Boot works), VMware ESXi, Proxmox and VirtualBox. A console menu handles the basics.
Goblin Sentry and G.O.B.L.I.N.
The first plugin, and a small brain that learns how you handle trouble.
Alerts become incidents
Sentry groups repeat IPS alerts into incidents and adds what the box knows: which way it went, which of your hosts (by name), and whether that address turned up before.
You stay in charge
It answers with a small toolbox (temporary block, watch, notify, ignore, escalate), never a shell. By default every block waits for your OK, your own hosts are never blocked, and each decision keeps a "why".
G.O.B.L.I.N.
A local decision model that learns from your answers. It runs on the box: no GPU, no cloud. Each version comes with a report card, is used only once you accept it, and rolls back in one click. It never blocks on its own.
Locked in a goblin-sized box
Plugins install as packages and each runs as its own throwaway, unprivileged user, on a read-only system, capped at one CPU core and 512 MB. A plugin can only make the API calls you approved under System → Plugins, and every call is audited. There's no token to leak: the box knows a plugin by its service.
Plugins can bring their own pages into the web UI, behind your login.
Words only go so far
Take the tour for screenshots, or run the demo on your own computer and click everything.
Every page is explained in the user guide.