Write your rules in the console
Interfaces, inbound, outbound and forwarded rules, aliases, NAT, import from OPNsense or pfSense: all in a draft you reread before loading.
Firewall and VPN modules
Two optional modules to write the firewall rules of the ToutWAF machine and prepare VPN access. They are off by default and not yet proven in production: this page says what exists, what does not, and how to try them safely.
Where to find it in the console : Administration menu: Settings, Modules tab; the Firewall and VPN sections appear in the menu only when the module is on.
Read this first
These two modules are experimental. We prefer to say so before describing anything.
- Off by default: an installation that never switches them on behaves exactly as before. Nothing is changed on the machine, no section appears in the menu.
- The firewall has never filtered real traffic on a real server. It is covered by unit tests and a simulated nftables, and by nothing else.
- The VPN generates and keeps configuration, nothing more: it starts no tunnel, opens no port and touches no network interface of the machine.
- Keep a second way into the machine during your tests (console on another path, SSH, your host's console) and start with a test machine.
What it is for
Do not cut yourself off
A guard simulates the flows that must never be cut, and every application is put on trial with an automatic return if you do not confirm.
Prepare VPN access
Keys, certificates and ready-to-use files for WireGuard, OpenVPN and IPsec/IKEv2, kept encrypted with the master key.
Nothing switches on by surprise
One switch per module, reserved to platform administrators, recorded in the audit log.
The firewall, from writing to loading
Nothing is loaded until you apply, and nothing is kept until you confirm.
A draft
Everything is edited in a draft. Saving it changes nothing on the machine.
The plan and the guard
« Show changes » compares with the rules in force and simulates the flows that must never be cut: console (443 and 9443), SSH (22), agent port (9444), ToutWAF and its peers. A flow cut everywhere is refused; a flow cut in part is a warning.
The 60-second trial
Applying loads the rules in their own nftables table, without touching the other tables, including those of firewalld. Without your confirmation within 60 seconds, the previous rules come back by themselves.
Off by default
Kostenlos
Settings > Modules, or the optional « Modules » step of the first-launch assistant. Only a platform administrator can change them.
- Off: the menu section is hidden, nothing is loaded and every route of the module answers with a clear refusal (409).
- On: the section appears for those who hold the read permission (firewall:read, vpn:read); the module acts on the machine only when you apply something.
- Switching off hides the module and deletes nothing: the draft, the history, the VPN servers and their sealed keys come back on reactivation. Rules already loaded in nftables are not removed by the switch: apply with the firewall disabled, or revert, before switching off.
- In this version, neither module is tied to a licence.
Firewall: what exists
Kostenlos
In the style of OPNsense, with nftables as the engine, on a Linux host.
- Named interfaces, one of which can be flagged « anti-lockout », which always keeps the console, SSH and the agent reachable at the top of the input chain.
- Inbound, outbound and forwarded rules: pass, block or reject, protocol, source and destination (address, network or alias, with « not »), ports, schedule, logging and order.
- Aliases (hosts, networks, ports), NAT (port forward, outbound masquerade, 1:1), revision history with restore into the draft.
- Import of the rules of an OPNsense or pfSense export (CSV or config.xml) or of a JSON file; a row that cannot be converted is skipped with a warning. An import never applies anything.
Firewall: what does not exist
This is not the firewall that opens the ports ToutWAF needs: that card, in Settings, always exists. This module is for your own rules.
- Reading firewalld's existing rules, and the Windows Firewall engine: the module writes its own table beside firewalld, and a drop in either one applies.
- DHCP, DNS, captive portal, gateway groups, scan and SYN-flood protection: not done.
- Static routes and gateways are stored but not applied. Country and URL-list aliases are accepted but not downloaded or expanded: while their content is empty, a rule that uses them matches nothing.
VPN: what exists
Kostenlos
The configuration of servers, clients and outgoing connections, generated and kept.
- WireGuard: keys, optional preshared key, collision-free IPv4 and IPv6 addresses, server file, one file per client and QR code text. OpenVPN: internal authority, certificates, .ovpn profile and revocation list. IPsec/IKEv2: strongSwan configuration, with username and password or client certificate.
- Creating a client returns its file once; downloading it again is audited. A client can be paused, rotated or revoked.
- Outgoing connections link this machine to an existing VPN (WireGuard, OpenVPN) without ever replacing the default route, unless explicitly asked, so the console stays reachable.
- Keys, certificates and passwords are sealed with the master key; they never appear in a list or in the audit log.
VPN: what does not exist
The page says it too: « Only the configuration is generated and stored. Nothing is started and no port is opened on this machine. »
- Starting and stopping tunnels, installing the server files, offering them for download and opening the port: not done. The state of the tunnels is not available on a standard installation.
- L2TP/IPsec and SSL VPN are in the list, marked « coming soon »: they are not implemented.
- The VPN neither adds nor checks any firewall rule: open the server's port yourself and, if the Firewall module is on, allow it there too.
What remains to be proven
We prefer to say it plainly.
- The guard is a model of the console, SSH, agent and peer flows; it cannot know your whole network (a peer known only by name is not checked).
- What happens to a trial if the control plane restarts is not vouched for, nor that confirmed rules come back after the machine reboots: after either, open Firewall and check the rules in force.
- The test bench covers only nftables and iptables. Nothing ran under a real systemd, nor on Windows or ARM.
- Neither module promises to replace your current edge firewall or VPN. Try them first on a test machine.
Use cases
Review OPNsense rules before adopting them
You import an export into the draft and read the plan without applying anything.
Prepare a team VPN's files
You generate a WireGuard server and each person's files, then install the server side yourself.
Try on a test machine
You apply a visible change, confirm or let the automatic return act, then decide.
What is included, by edition
In this version neither module is tied to a licence; that may change.
EditionKostenlos In allen Angeboten enthalten, auch in den beiden kostenlosen (Free und Free +)Pro und höher Kostenpflichtige Angebote: in der Konsole sichtbar, ohne Lizenz gesperrt. Ab Pro, sofern nicht Agency oder Enterprise angegeben ist
- Firewall: inbound, outbound and forwarded rules loaded with nftables, aliases, NAT, OPNsense and pfSense import, history (not yet proven in production)Kostenlos
- Guard against locking out the console and SSH, and automatic return of the rules after 60 seconds without confirmation (not yet proven in production)Kostenlos
- VPN: WireGuard, OpenVPN and IPsec/IKEv2 servers with their clients; the configuration is generated and kept, no tunnel is started (not yet proven in production)Kostenlos
- Outgoing connections from this machine to an existing VPN (WireGuard, OpenVPN), without replacing the default route unless explicitly asked (not yet proven in production)Kostenlos
- One switch per module in Settings > Modules, reserved to platform administrators; switching a module off hides it and deletes nothingKostenlos
Every function in this list carries the note « not yet proven in production ». The data plane, for its part, never consults the licence.
Stellen Sie noch heute einen Schild vor Ihre Anwendungen
Installieren Sie es auf Ihrem eigenen Server oder schreiben Sie uns, um über Lizenzen zu sprechen.