Programmable network gateway,in one daemon.
The Gateway runs your firewall, DNS, VPN tunnels, mesh, traffic splitter and kill-switch as one Go process — and exposes the whole stack through a single REST API and web UI. The current v2.13.1 release fixes encrypted DNS enforcement and leak verification, redacts credentials from diagnostics, and repairs the automatic rollback path.
$ gwctl observer
Overall: healthy
COMPONENT STATUS CHECKS FAILS
dns ok 1247 0
transport ok 1247 0
firewall ok 1247 0
mesh ok 1247 0
$ gwctl evaluate laptop-alice | jq .
{
"policy": "alice-private",
"profile": "high-privacy",
"action": "pool",
"endpoints": ["wg-eu-01","wg-eu-02","wg-eu-03"],
"fwmark": "0x701-0x703",
"fail_policy": "closed",
"dns": "gateway"
}
$ gwctl tunnels down wg-eu-02
Tunnel wg-eu-02 brought down
$ _v2.13.1 is live on the download path.
The public installer now serves the v2.13.1 scripts and checksum-verified `gatewayd` binaries from `/releases/latest/`, with a pinned archive at `/releases/v2.13.1/`.
Built for technical operators.
Not a one-click consumer VPN appliance. The Gateway gives you per-device routing, fail-closed guarantees, and one control plane for every kernel-level resource it touches.
One binary, one UI
Single Go daemon. SQLite for state. Integrated DNS resolver. No broker, no message queue, no Kubernetes.
Fail-closed by default
Reserved route tables are blocked, dangling profiles fail closed, and WAN-side admin access is controlled by policy.
Per-device, per-domain
Route one laptop through one tunnel, pin domains safely, keep DNS and DHCP decisions aligned with observed device identity.
Privacy levels 0 → 5
Tune from performance to maximum: round-robin or crypto-random selection, packet padding, Poisson cover traffic, HTB bandwidth shaping.
Censorship-resistant
Bridge endpoint pins follow edits and disable states, preserve shared host routes, and keep buffered CONNECT bytes intact.
Federated by design
Peer multiple gateways over mesh, with address sync, protocol-aware manifests, and safer push/pull boundaries.
Every plane of your network, in one process.
Devices enter through nftables. Policy decides which tunnel. The splitting engine spreads connections across exits. DNS is intercepted, filtered and rotated. A reconciler watches every kernel object and re-applies anything that drifts.
- Kernel-fast dataplane. Slot selection is
nftables numgen— no userspace per packet. - Self-healing. Drift events surface on the Reconciliation page, fixed on the next minute-cadence tick.
- Auditable. Every config-changing API call is logged with operator and source IP.
What's in the box.
Eleven subsystems. One coherent control plane.
DNS plane
Integrated recursive resolver, per-device filtering, zones, rewrites, telemetry block, Pi-hole sync.
explore →VPN tunnels
WireGuard and OpenVPN with fwmark policy routing, latency probes and auto-reconnect.
explore →Traffic splitting
Round-robin across exits with 6 privacy levels, cover traffic and per-policy isolation.
explore →Bridge proxies
SOCKS5 → TLS / obfs4 relays on uncensored VPSes. SNI fronting. Decoy site.
explore →Mesh networking
Tailscale or self-hosted Headscale for inter-gateway connectivity and remote access.
explore →Privacy & kill-switch
Reference-counted fail-closed firewall, IPv6/QUIC/WebRTC blocks, leak monitor.
explore →Routing policies
Per-device, per-domain, per-interface steering with exceptions and TTLs.
explore →Federation
Peer gateways over an existing mesh. Per-kind roles. Operator-triggered push / pull plus an auto-sync prober.
explore →Alerts & monitoring
Alert rules with webhook and Telegram dispatch. Drift events. Anomaly heuristics.
explore →AI assistant
Local Ollama-powered assistant that proposes structured policy actions you review.
explore →Backup
AES-256-GCM, passphrase-derived (PBKDF2). Scheduled local + remote SFTP push. GCM tag is the integrity check.
explore →gwctl + REST
Anything you can click you can script. JSON-CRUD pattern, single REST surface, bearer-token auth.
explore →From a Pi in a backpack to a federated cluster.
Five concrete deployment shapes, each documented end to end — topology, policies, kill-switch behaviour and trade-offs.
Anti-censorship family router
Pi 4 at home. Adults on a split tunnel pool, kids on a bridge, IoT direct. Fail-closed for everyone.
walkthrough →02Self-hosted travel router
Pi in a backpack. Single NIC, portable mode, hotel WiFi upstream, your own WPA2 AP downstream.
walkthrough →03Small office gateway
Per-role routing. Devs direct, finance VPN-only with kill-switch, HR via bridge. Compliance alerts.
walkthrough →04Dual-WAN load balancing
Two ISP uplinks. Per-connection split with session affinity. Automatic failover, no manual scripts.
walkthrough →05Hybrid home lab
Home Pi + remote VPS, federated and meshed. Stable inbound point. Egress diversity. One UI.
walkthrough →→All use cases
See every deployment shape with full topology, policies, devices and a "what happens when" matrix.
browse all →From bare metal to your first kill-switch in ten minutes.
Three steps. None of them require touching nftables by hand.
Install
One installer script with five profiles (rpi, vps, node, full, custom). Creates the systemd unit, TLS cert, and SQLite store. Doesn't auto-start so you can review.
Add a tunnel + a device
Paste a WireGuard config from your provider. Register one device by MAC. Both from the web UI, the REST API, or gwctl.
Create a policy
Match the device, route through the tunnel, set fail_policy: closed. Test the kill-switch by bringing the tunnel down. Done.
Take it for a spin.
Install on a spare Pi or a $5/month VPS. The installer is profile-driven —rpi, vps, node, full, or custom — and brings up a TLS-fronted web UI on first boot.