Source code · soon on GitHubSoon on GitHub

Open-source NGFW for Debian 13 and Ubuntu 26.04 LTS

A firewallthat showsits work.

Furta NGFW turns a Linux box into a next-generation firewall: zone policy compiled to nftables, Suricata inspection, site-to-site tunnels and the Furta VPN with fresh MFA on every connection. Every decision it makes, you can trace.

Follow a packet Install

Open source under Apache-2.0 · amd64 and arm64 · installs offline

ppp-wanwg0dmz0lan0guest0furta-ngfwnftables · OVS · SuricataWANinternetVPNstaff on Furta, fresh MFALANofficeGUESTWi-FiDMZpublic web server
A laptop opens a website Forwarded

Follow a packet

Ten checkpoints, in the order the box runs them.

TCP 192.168.10.23:40000 → 198.51.100.7:443 LAN → WAN
  1. Anti-spoofing pre_raw · prerouting · raw −300 LAN is strict: the source routes back through lan0.
  2. Connection tracking conntrack · lookup A new flow.
  3. Destination NAT pre_dnat · prerouting · nat −100 No destination NAT rule matches.
  4. Routing routing · decision Out through ppp-wan, the PPPoE uplink.
  5. MSS clamp fwd_mangle · forward · mangle −150 MSS clamped to fit the PPPoE link.
  6. Furta VPN ACL furta/forward · forward · filter 0 Neither side is the VPN interface.
  7. Zone policy zone_forward · forward · filter 10 LAN → WAN, policy 20 accepts. The flow's mark remembers the policy and profile.
  8. Suricata inspection ips_dispatch · forward · filter 20 Profile lan-outbound (fail-closed): Suricata lets it through.
  9. Source NAT post_snat · postrouting · nat 100 Masqueraded to the WAN address.
  10. Leaves the box egress · out
Forwarded policy 20 · counter policy_20

Built on

Changing the firewall

Nothing sticks until you confirm it.

A change that could cut your own connection is applied as one transaction and waits for you. Confirm it from the session it didn’t break, or the box puts the last good configuration back.

  1. Validate. Schema, meaning, capabilities, dependencies, and whether you can still reach the box afterwards.
  2. Apply as one transaction. Interfaces, routes, nftables and services move together.
  3. Confirm within the window. 120 seconds by default for changes that touch connectivity.
  4. Or roll back. No confirmation, a failed health check, an agent restart or a reboot all restore the last good configuration.

SSH and the admin UI stay reachable through a management anchor the policy can’t remove. If you still lock yourself out, furta-ngfwctl on the console repairs it.

Try it

Confirm revision 8 within

The clock runs four times faster here. Confirm, or let it run out.

Revision 7
committed · last good
Revision 8
awaiting confirmation

What’s in the box

One box, the whole edge.

Grouped the way the admin UI is, from the uplink to the audit log.

Network

  • Interfaces, VLANs, PPPoE and routing, owned by a host agent with scoped nftables tables
  • Open vSwitch bridges: one L2 segment per zone, so traffic between zones is always routed through policy
The WAN page: the ISP fibre uplink, its status by layer and a traffic chart for the last hour.

Firewall

  • Zone-pair policy with objects and services, compiled to nftables
  • Destination NAT, source NAT and hairpin, plus policy simulation for any packet
  • Policies by zone pair or in sequence, with counters, clone and bulk actions
Forward policies grouped by zone pair (WAN to DMZ, LAN to WAN and DMZ, Lab to LAN) with packet and byte counters and the last time each rule matched.

LAN services

  • Kea DHCP, Unbound DNS, router advertisements and a setup wizard
DHCP leases with a warning that the 192.168.10.0/24 pool is 93 % assigned.

Guided setup

  • A seven-step setup wizard: WAN, LAN, segments, services, protection, review, then checks that run after the apply
  • Presets for a home network, a guest network or an office with a DMZ, shown as a diff before anything is applied
  • Help in a side drawer for every page and field
Presets: guided scenarios such as home network, home with guest network, and office with guest and DMZ, with the changes a preset would make.

VPN

  • Furta remote access: fresh MFA on every connection, with zone policy on top of Furta's ACL
  • Site-to-site with strongSwan IKEv2 (policy- and route-based, FortiGate and Firepower presets) or WireGuard
Site-to-site tunnels: IPsec to FortiGate and Cisco peers and WireGuard, with state, rekeys and guard drops.

Security

  • DNS filtering from HaGeZi and URLhaus, GeoIP objects, dynamic sets with bounded memory
  • Suricata IDS or IPS over NFQUEUE, profiles per policy, rule sources and datasets, updates with validation and rollback
An inspection alert opened from the event list: SID 2019401, its source, destination, flow and rule text.

Overlays

  • VXLAN and GENEVE segments over Open vSwitch, with drift detection, an MTU budget and flow export
VXLAN overlays with their VNI, zone, underlay, peers and MTU budget.

Operations

  • Roles, audit log, transactional apply with confirm-or-rollback and a local recovery CLI
  • A live topology map of uplinks, zones, bridges, tunnels and segments
  • Dashboards, sessions, alarms and Prometheus /metrics; diagnostics with TCP connect, conntrack, neighbours and bounded packet capture
The topology map: the fibre uplink, the firewall, WAN, LAN, guest, DMZ and branch zones, with their bridges, VLANs, tunnels and overlay segments.

The admin UI

Ask first, then apply.

Simulate any packet against the configuration you are about to apply, then watch the box carry it out.

Policy simulation: a TCP packet from 192.168.10.23 to 198.51.100.7:443, accepted by policy 20 with inspection profile lan-outbound and masqueraded on the WAN.
Policy simulation answers from the stored configuration, before anything is applied.
A route-based IPsec tunnel to a FortiGate peer: IKE established, child SAs, routing table and kill-switch guard.
Site-to-site tunnels show their IKE state, routes and kill-switch drops. Keys are write-only.
The dashboard in the light theme: WAN traffic chart, alarms and sessions. The same dashboard in the dark theme.
Light, dark, or following your system. Drag to compare.

Install

Put it on a spare box.

Furta NGFW ships as an offline bundle for a fresh Debian 13 or Ubuntu 26.04 LTS host, amd64 or arm64, with two NICs (or one NIC and a VLAN-capable switch). It downloads nothing while it installs. To upgrade, copy the new bundle over and re-run the installer with the same management address.

The source, the bundle and the install guide will be published on GitHub.

admin@ngfw: ~

  1. # Mask the stock nftables service: its start and stop flush the whole ruleset.

    sudo systemctl mask nftables.service

  2. # Optional: site-to-site IPsec and Suricata come from your distribution (suricata 8.0: trixie-backports on Debian 13).

    sudo apt install charon-systemd strongswan-swanctl suricata

  3. # Check the download against the published checksums.

    sha256sum -c --ignore-missing SHA256SUMS

    furta-ngfw-offline_<version>_linux_amd64.tar: OK

  4. # Unpack the bundle for your architecture.

    tar -xf furta-ngfw-offline_*_linux_amd64.tar && cd furta-ngfw-*/

  5. # Install. SSH and the admin UI open on the management interface, from its subnet only.

    sudo ./install.sh --mgmt-ip 192.0.2.10 --with-furta-gateway