Topics / #firewall

Firewall projects on GitHub

Firewalls, reverse proxies and perimeter security tooling.

As of , the most-starred Firewall projects on GitHub are frp (110K stars), appwrite (57.7K stars) and fanqiang (54.2K stars). GitHub.Locker tracks 41 Firewall repositories with 805.1K stars combined. The fastest-growing on October 16 was anubis, with +38 stars in a day.

41Projects
805.1KStars in total
+298Stars in a day
Browse in the catalog →github.com/topics/firewall ↗

Hot right now

Most stars gained in a day · Oct 16

+38

anubis

TecharoHQ/anubis · ★ 23.5K

Anubis is a Web AI Firewall Utility that weighs the soul of incoming connections with challenges to protect upstream resources from AI scraper bots — built to defend the small internet from endless storms of AI-company requests.

+28

fanqiang

bannedbook/fanqiang · ★ 54.2K

A collection of tutorials and tools for circumventing China's internet censorship (翻墙/科学上网), covering proxy protocols like V2Ray, Shadowsocks, SSR and Trojan, plus a bundled all-in-one client package for Windows.

+28

netbird

netbirdio/netbird · ★ 30K

NetBird is an open-source Zero Trust networking platform: it builds a configuration-free peer-to-peer WireGuard overlay network with centralized access control, so you can create secure private networks without open ports, complex firewall rules or VPN gateways.

+21

frp

fatedier/frp · ★ 110K

frp is a fast reverse proxy that lets you expose a local server sitting behind a NAT or firewall to the internet, forwarding TCP, UDP, HTTP and HTTPS traffic, with an optional P2P mode for direct client-to-client transfers.

The all-time top

41 projects · by stars

  1. #1 · fatedier/frp

    frp

    frp is a fast reverse proxy that lets you expose a local server sitting behind a NAT or firewall to the internet, forwarding TCP, UDP, HTTP and HTTPS traffic, with an optional P2P mode for direct client-to-client transfers.

    110K
  2. #2 · appwrite/appwrite

    appwrite

    Appwrite is an open-source, all-in-one backend platform for building web, mobile, and AI apps, bundling authentication, databases, storage, serverless functions, messaging, realtime, and web hosting in one place.

    57.7K
  3. #3 · bannedbook/fanqiang

    fanqiang

    A collection of tutorials and tools for circumventing China's internet censorship (翻墙/科学上网), covering proxy protocols like V2Ray, Shadowsocks, SSR and Trojan, plus a bundled all-in-one client package for Windows.

    54.2K
  1. 4

    nps

    34.2Kehang-io/nps · Go

    NPS is a lightweight, high-performance intranet penetration (reverse proxy/tunnel) server that exposes internal network services to the outside world. It forwards tcp, udp, http(s), socks5 and other protocols, and comes with a full-featured web admin panel.

  2. 5

    How-To-Secure-A-Linux-Server

    31.8Kimthenachoman/How-To-Secure-A-Linux-Server

    This is a long-form, evolving how-to guide (written as a GitHub README) that walks you through hardening a self-hosted Linux server, step by step, from SSH to firewalls to intrusion detection.

  3. 6

    lede

    31.6Kcoolsnowwolf/lede · C

    Lean's LEDE source: a hugely popular OpenWrt/LEDE fork for building your own router firmware, extended with support for domestic Chinese CPUs like Loongson loongarch64 and Phytium Tengrui D2000.

  4. 7

    algo

    30.4Ktrailofbits/algo · Python

    A set of Ansible scripts that spins up your own personal WireGuard and IPsec VPN server on a cloud provider, using the most secure defaults available.

  5. 8

    netbird

    30Knetbirdio/netbird · Go

    NetBird is an open-source Zero Trust networking platform: it builds a configuration-free peer-to-peer WireGuard overlay network with centralized access control, so you can create secure private networks without open ports, complex firewall rules or VPN gateways.

  6. 9

    setup-ipsec-vpn

    28.7Khwdsl2/setup-ipsec-vpn · Shell

    A set of shell scripts that turns a fresh Linux server into your own IPsec VPN server in minutes, with IPsec/L2TP, Cisco IPsec and IKEv2 modes. Traffic is encrypted so nobody between you and the server can eavesdrop.

  7. 10

    druid

    28.2Kalibaba/druid · Java

    Druid is an open-source, high-performance Java database connection pool and SQL parser built by Alibaba's DataWorks team. It combines a JDBC connection pool, a multi-dialect SQL parser/AST analyzer, a SQL firewall, and monitoring statistics into one library.

  8. 11

    OpenClash

    27.8Kvernesong/OpenClash · JavaScript

    OpenClash is a Mihomo (Clash) client plugin for OpenWrt routers: it runs a policy-based proxy on the router, routing traffic through flexible rule configurations.

  9. 12

    ngrok

    24.4Kinconshreveable/ngrok · Go

    ngrok is a globally distributed reverse proxy that secures, protects and accelerates applications and network services wherever they run, combining a reverse proxy, firewall, API gateway and global load balancer into one tool.

  10. 13

    anubis

    23.5KTecharoHQ/anubis · Go

    Anubis is a Web AI Firewall Utility that weighs the soul of incoming connections with challenges to protect upstream resources from AI scraper bots — built to defend the small internet from endless storms of AI-company requests.

  11. 14

    SafeLine

    22.8Kchaitin/SafeLine · Go

    SafeLine is a self-hosted web application firewall (WAF) and reverse proxy that protects your web apps from attacks and exploits by filtering and monitoring HTTP traffic.

  12. 15

    macOS-Security-and-Privacy-Guide

    22.6Kdrduh/macOS-Security-and-Privacy-Guide · Shell

    A community-maintained guide collecting techniques for improving security and privacy on macOS, written for Apple silicon Macs.

  13. 16

    teleport

    21Kgravitational/teleport · Go

    Teleport is an open-source access platform for infrastructure: connectivity, authentication, access controls and audit for servers, Kubernetes, databases, desktops and web apps — without long-lived keys or passwords.

  14. 17

    Sandboxie

    19.7Ksandboxie-plus/Sandboxie · C

    Sandboxie is a sandbox-based isolation tool for Windows that lets you run or install untrusted programs in an isolated virtual environment without permanently modifying your drives or registry.

  15. 18

    fail2ban

    18.8Kfail2ban/fail2ban · Python

    Fail2Ban is a daemon that scans log files like /var/log/auth.log, spots hosts making too many failed login attempts, and bans them by updating system firewall rules for a configurable amount of time.

  16. 19

    nebula

    18.4Kslackhq/nebula · Go

    Nebula is an overlay networking tool that lets you connect computers anywhere in the world into a secure mesh network, scaling from a handful of machines to tens of thousands.

  17. 20

    openvpn-install

    16.2Kangristan/openvpn-install · Shell

    An installer script that sets up and manages your own OpenVPN server on a Linux machine you control — a VPS, a dedicated server or even a home computer — and generates client config files for every device you want to connect.

  18. 21

    gluetun

    15.8Kpassteque/gluetun · Go

    Gluetun is a lightweight, swiss-army-knife-like VPN client packaged as a single small Docker container. It tunnels through 20+ commercial VPN providers via OpenVPN or Wireguard and lets other containers or LAN devices share that connection.

  19. 22

    crowdsec

    15.2Kcrowdsecurity/crowdsec · Go

    CrowdSec is an open-source IDS/IPS and WAF that detects malicious behavior by analyzing logs and HTTP requests, blocks bad actors locally, and shares anonymized attack data with a crowdsourced network to build a real-time community blocklist.

  20. 23

    awesome-security

    15Ksbilly/awesome-security

    A curated, categorized collection of well-known security resources — software, libraries, documents, books and other cool stuff — maintained by the community in the spirit of awesome-php and awesome-python.

  21. 24

    rathole

    14.3Krathole-org/rathole · Rust

    Rathole is a secure, stable, high-performance reverse proxy written in Rust that exposes a service running on a device behind NAT to the Internet through a server with a public IP, similar to frp and ngrok.

  22. 25

    opensnitch

    14.2Kevilsocket/opensnitch · Python

    OpenSnitch is an interactive application firewall for GNU/Linux, inspired by macOS's 'Little Snitch', that lets you see and approve or block each app's outgoing connections in real time.

  23. 26

    portmaster

    13.9Ksafing/portmaster · Go

    Portmaster is a free, open-source application firewall for Windows and Linux that intercepts all network traffic on your machine, letting you monitor and block connections per app, filter DNS, and block trackers and malware with good defaults out of the box.

  24. 27

    LuLu

    13.3Kobjective-see/LuLu · Objective-C

    LuLu is a free, open-source firewall for macOS: it watches the network connections apps on your Mac try to make and lets you allow or block them.

  25. 28

    ubicloud

    12.3Kubicloud/ubicloud · Ruby

    Ubicloud is an open source cloud platform that runs on bare metal servers, offering elastic compute, non-replicated block storage, firewall and load balancer, managed Postgres, Kubernetes, AI inference, and IAM services as an open alternative to AWS.

  26. 29

    smartdns

    11.3Kpymumu/smartdns · C

    SmartDNS is a local DNS server that forwards each query to multiple upstream DNS servers, measures which resolved IP responds fastest, and returns that IP to the client for a faster browsing experience. It also supports DoT, DoH, DoQ and DoH3 for privacy and can act as an ad filter by mapping specific domains to chosen IPs.

  27. 30

    sovereign

    10.6Ksovereign/sovereign · HTML

    Sovereign is a set of Ansible playbooks that build and maintain your own private cloud on a server you control, bundling email, calendar/contacts sync, file storage, VPN, an IRC bouncer, webmail, and more.

  28. 31

    ProxyBridge

    6.8KInterceptSuite/ProxyBridge · C

    ProxyBridge is a cross-platform proxy client that transparently redirects TCP and UDP traffic from specific Windows/macOS/Linux applications through SOCKS5 or HTTP proxies, acting as an open-source alternative to Proxifier.

  29. 32

    russia-mobile-internet-whitelist

    3.8Khxehex/russia-mobile-internet-whitelist

    A community-maintained list of domains and IP ranges that stay reachable in Russia even when mobile internet gets throttled or filtered, meant to be fed into VPN or proxy clients so their traffic blends in with what the government allows through.

  30. 33

    Open-Box

    2.2Kliandu2024/Open-Box · Shell

    Open-Box is an all-in-one transparent proxy solution for OpenWrt routers: it installs the sing-box core plus a web management panel with a single command, so you can set up proxy routing from a browser without hand-editing any config files.

  31. 34

    Linux-

    1.1Kjustxor/Linux-

    This is a free, extensive Russian-language Linux and Bash cheat sheet: it explains how Linux works (files, processes, permissions, memory, boot, networking) in plain language, lists terminal commands with examples, and includes an advanced track covering LVM/RAID, kernel tuning, containers, security hardening, and system recovery, plus interview questions and hands-on practice tasks.

  32. 35

    azerioid-stack-manager

    710azerioid/azerioid-stack-manager · PHP

    AZERIOID Stack Manager is a self-contained stack manager and web control panel for operators who run sites on a single Linux server. It bootstraps Caddy, a dedicated PHP-FPM pool and a SQLite-backed admin UI, then lets you add web servers, databases, cache, mail, Node.js and rootless Docker on demand.

  33. 36

    casbin-gateway

    642apache/casbin-gateway · Go

    An open-source gateway for the AI coding agents on your machine: it watches what every agent does, relays their model traffic through one endpoint covering 44 vendors, and grades whether the API behind each key is what you actually paid for.

  34. 37

    blocklist-abuseipdb

    600borestad/blocklist-abuseipdb · Shell

    A continuously updated set of IP blocklists aggregating AbuseIPDB's worst IPv4 and IPv6 offenders (~99% confidence), plus other free public threat sources, meant to be loaded straight into a firewall to block malicious traffic.

  35. 38

    3X-UI_KIT

    450itsnotkubrick/3X-UI_KIT · Shell

    A script that turns a clean VPS into a ready VPN server in minutes: it installs the official 3X-UI panel, sets up 11 popular protocols, a certificate and a firewall, and gives you one subscription link. No domain needed.

  36. 39

    Free-Configs

    385patterniha/Free-Configs · Python

    A free collection of proxy configs for getting around internet filtering: add its subscription link to a client app and it feeds you working configs, refreshed every 24 hours.

  37. 40

    wificalling-location-gateway

    245smthdagg/wificalling-location-gateway · Rust

    An all-in-one gateway for OpenWrt/ImmortalWrt routers: a Rust daemon routes a designated test device's Wi-Fi Calling through a chosen sing-box node and rewrites Apple WLOC location responses so they match that node's region, all managed from a LuCI web UI.

  38. 41

    nyx

    158thecynetx/nyx · TypeScript

    Nyx Panel is a self-hosted web management suite for Xray-core proxy servers, built to resist heavy censorship (Iran-focused) using VLESS+REALITY, XHTTP/SplitHTTP, packet fragmentation and Cloudflare WARP.

Often tagged together