frp is a high-performance reverse proxy application that exposes local services behind NAT or firewalls to the internet. It implements a client-server architecture where the frpc client connects to the frps server, registers proxies (TCP, UDP, HTTP, HTTPS, STCP, XTCP, TCPMUX), and tunnels traffic through encrypted, compressed connections. The system supports multiple transport protocols (TCP, KCP, QUIC, WebSocket, WSS), authentication (token, OIDC), health checks, load balancing, bandwidth limiting, and a plugin system for both client and server extensions. It also includes NAT hole punching for direct peer-to-peer connections and an SSH tunnel gateway that allows SSH clients to create tunnels without frpc. The codebase is well-structured with clear separation of concerns: configuration loading and validation in pkg/config/, wire protocol and message handling in pkg/msg/ and pkg/proto/, network utilities in pkg/util/net/, and proxy implementations in server/proxy/ and client/proxy/. The project includes comprehensive end-to-end tests, a Vue.js web dashboard for both server and client management, Prometheus metrics, and a store API for dynamic proxy configuration at runtime. The architecture is modular, using factory patterns for proxy types, visitor patterns for P2P connections, and an aggregator pattern for merging configuration sources. Despite its complexity, the codebase is actively maintained with regular releases, extensive documentation, and a large community. It demonstrates strong engineering practices including interface-based design, dependency injection for testability, and careful concurrency management. The main technical debt is the coexistence of legacy INI configuration and v1 wire protocol alongside newer formats, but these are well-isolated and migration paths are provided.
OPNsense core is the central management and control plane for the OPNsense open-source firewall distribution. It implements a complete MVC web application (PHP) that provides a graphical user interface and RESTful API for configuring firewall rules, VPNs (IPsec, OpenVPN, WireGuard), DNS/DHCP services, traffic shaping, intrusion detection, captive portal, system settings, and monitoring. The backend relies on a custom daemon (`configd`) that executes actions via Unix socket, running Python and shell scripts for system-level operations (e.g., pfctl, ipfw, swanctl, wg). Configuration is stored in XML files and managed through an extensive model layer with field types, validators, and migrations. The system is deeply integrated with FreeBSD and uses FreeBSD-specific tools and kernel subsystems (pf, carp, netgraph). The architecture is a monolithic PHP MVC framework (originally based on Phalcon, now with a custom dispatcher) with a clear separation: controllers handle HTTP requests, models manage XML-based configuration, and views are Volt templates. The API controllers extend `ApiMutableModelControllerBase` and provide standard CRUD operations plus service actions (start, stop, reconfigure). System scripts are organized under `src/opnsense/scripts/` and are invoked by configd or system hooks. Dashboard widgets (JavaScript) fetch real-time data via API endpoints or event streams. External dependencies include FreeBSD base system tools, PHP (with Phalcon or custom replacement), Python 3, and libraries like ujson, requests. Key entry points are the web UI (`/index.php`), the API (`/api.php`), and the configd daemon (`configd.py`). Data flows primarily from user input through controllers to model validation, then to configd actions that generate configuration files (templates) or execute system commands. The system is actively maintained with frequent commits, extensive unit tests for both PHP and Python components, and a well-structured migration framework for upgrading configurations.
This repository contains the official IVPN desktop client, a multi-platform VPN application supporting Windows, macOS, and Linux. It is composed of three main components: a privileged Go daemon that manages VPN connections (OpenVPN, WireGuard, V2Ray), firewall (kill switch), DNS (including DNSCrypt-proxy for DoH), split tunneling, and WiFi trusted networks; a Go CLI for command-line control; and an Electron/Vue.js UI for graphical interaction. The daemon and clients communicate over a local TCP JSON protocol with authentication and event push. The codebase demonstrates strong engineering practices: platform abstraction via build tags, a custom ICMP ping library, a reusable logger, a type-safe IPC client library documented for third-party integration, and Windows WFP wrappers for firewall and split tunneling. Build scripts and native projects (Windows kernel driver, macOS helpers) handle cross-platform packaging and signing.
Safety is a commercial CLI tool for software supply chain security, primarily scanning Python (and limited npm) dependencies for known vulnerabilities. It operates as a multi-command CLI built with Click and Typer, offering commands such as `scan`, `check`, `auth`, `firewall`, `init`, and `codebase`. The architecture is modular: a core scanning engine (`safety/scan/`) discovers dependency files (requirements.txt, pyproject.toml, Pipfile.lock, etc.), resolves packages, and matches them against a proprietary vulnerability database fetched from the Safety platform. Results are formatted via a pluggable formatter system (JSON, HTML, screen, text, SPDX) and can be uploaded to the platform for reporting. The tool also includes a firewall mode that intercepts pip/poetry/uv/npm install commands to block malicious packages in real time, using shell aliases (Unix) or registry/autorun (Windows). Authentication is multi-modal: OAuth2 (browser-based), API keys, and machine tokens, with a complex enrollment flow for enterprise MDM. An internal event bus (`safety/events/event_bus/bus.py`) provides async telemetry and audit trail emission, used throughout auth, init, and scan workflows. The codebase demonstrates strong engineering practices: layered configuration resolution (CLI > env > config file > default), a command wrapper pattern for package managers, and a policy file system (YAML) for ignoring vulnerabilities by severity, CVSS score, or expiration. However, there is notable technical drift: the legacy `check` and `license` commands are deprecated but still present, typing is incomplete in several modules, and the Windows firewall interceptor relies on fragile registry manipulation. The test suite is extensive but heavily mocks external services, making integration tests brittle. External dependencies include `httpx`, `authlib`, `tenacity`, `rich`, `pydantic`, `dparse`, `packaging`, `certifi`, `filelock`, and the proprietary `safety-schemas` package. The tool is distributed as a PyPI package and as a GitHub Action, with CI/CD pipelines building platform-specific binaries via PyInstaller and PyApp. Overall, Safety is a mature, feature-rich security tool with a well-architected core, though some areas show signs of rapid feature growth and legacy debt.
This is an Ansible role and playbook collection that automates the hardened installation of the OpenClaw messaging gateway on Debian/Ubuntu Linux systems. It provisions a dedicated system user, installs Docker CE with UFW-based firewall and DOCKER-USER chain isolation, configures fail2ban and unattended-upgrades, sets up Node.js and pnpm, and installs OpenClaw either from npm (release mode) or from a Git checkout (development mode). The role does not configure the application or install its systemd service—those steps are left to the operator via `openclaw onboard --install-daemon`. It supports remote deployment via inventory and includes CI tests for syntax, linting, and integration. The codebase is well-structured, security-conscious, and actively maintained, though it does not contain independently extractable components suitable for reuse outside this project.
simplewall is a native Windows desktop application that functions as a personal firewall using the Windows Filtering Platform (WFP). It controls per-application network access via user-defined rules and blocklists, including built-in Microsoft spy/telemetry lists. The application provides a full GUI with tabs for applications, services, UWP packages, rules, network connections, and logs, along with a tray icon, notification popups, and a rule editor. It logs allowed/blocked connections to a CSV file and supports real-time network monitoring via TCP/UDP statistics (including ETW-based UDP accounting). Profiles are stored in XML format with optional compression and AES encryption, and filters can be installed permanently, temporarily, or at boot time. The architecture is a monolithic C/C++ Win32 application with a custom utility library ("routine") as a submodule. Key modules handle WFP filter lifecycle, WFP net event subscription, network connection enumeration, security descriptor management, and UI controls (listview, search bar, notifications). The code demonstrates deep Windows internals knowledge, including WFP version-specific callbacks, ETW session management, cryptographic hashing, and digital signature verification. While the application is actively maintained (latest beta v3.9.1 as of July 2026), it is tightly coupled to Windows APIs and contains workarounds for historical Microsoft bugs, leading to moderate technical drift risk. Strengths include comprehensive WFP integration, robust logging, and a well-organized codebase with reusable patterns for WFP security (ACL management) and ETW-based UDP monitoring. Weaknesses include reliance on a private library submodule, hardcoded service/port lookup tables, and Windows version-specific branches that may need adjustment for future releases. The project is suitable for developers seeking a reference implementation for WFP firewall development or a reliable Windows filtering tool.
The Global Socket Toolkit (gsocket) is a secure networking utility suite that enables TCP connections across NATs and firewalls without requiring any inbound ports. It achieves this by relaying traffic through a free cloud-based relay network (GSRN) and encrypting the session end-to-end using SRP (RFC 5054) with AES-256 and a 4096-bit prime. The project provides a core library (`libgsocket`) that abstracts the relay protocol, and several command-line tools: `gs-netcat` (a netcat-like tool for data transfer, reverse shells, port forwarding, and SOCKS proxies), `gs-sftp` (SFTP through the relay), `gs-mount` (sshfs mounting), and `blitz` (bulk file transfer). It also includes a `LD_PRELOAD`-based interposition library (`gsocket_dso`) that can transparently redirect existing network applications through the relay. The architecture is client-server with a relay network; the client establishes a connection to the relay using a shared secret token, and the server connects to the same token, allowing the relay to bridge the two. The codebase is written in C and Bash, with autotools build system, extensive cross-platform support (Linux, macOS, FreeBSD, OpenBSD, Solaris, Cygwin, OpenWRT), and CI/CD pipelines for publishing static binaries. It is a dual-use tool: it can be used for legitimate remote administration, secure file transfer, and privacy, but also includes documented patterns for hidden reverse shells and persistence, which introduces security and maintenance risks.
This is a LuCI application package for OpenWrt routers that provides a full web-based management interface for Clash/Mihomo proxy services. It handles the complete proxy lifecycle: service management via procd, transparent proxy setup (TPROXY/TUN/MIXED modes), DNS manipulation, firewall rule generation via nftables/iptables, subscription management, and a real-time log viewer. The package installs to /opt/clash/ and integrates deeply with OpenWrt's hotplug, UCI, and LuCI systems. A separate Vue-based SPA dashboard (zashboard) is bundled for advanced features like Tailscale management, network diagnostics (bandwidth tests, STUN NAT detection), and an embedded SSH terminal. The architecture is a classic OpenWrt package: shell scripts for service and firewall management (/etc/init.d/clash, /opt/clash/bin/clash-rules), LuCI JavaScript views for the admin UI (config, settings, rulesets, log), hotplug scripts for network events, and a vendored Ace editor for YAML editing. The firewall engine is the most substantial component — roughly 1400 lines of modular shell that generates nftables/iptables rules, manages subscription IP caches with locking, and auto-generates fake-IP whitelists from rule providers. The init script includes rollback logic that restores DNS/firewall state on failure, preventing bricked router connectivity. The repository is explicitly legacy: the README states active development has moved to SSClash-Go (a single static binary with built-in web UI). This repo receives bugfix maintenance only. Technical drift is medium — the vendored Ace editor is an old version (1.5.0), the shell scripts use fragile heuristics for YAML transformation, GitHub API calls for kernel downloads lack caching, and the dual configuration (config.yaml plus /opt/clash/settings) can confuse users. However, the CI pipeline is maintained and the package builds for current OpenWrt versions (both ipk and apk formats). For reuse, the most valuable components are the modular firewall engine pattern (nft/iptables abstraction with idempotent rule generation), the procd init script with rollback logic, and the LuCI view utilities (chunked file writing, service polling). These could be extracted for other OpenWrt proxy/VPN services with minimal modification. The repo serves as a solid reference for OpenWrt package structure, LuCI app development, and transparent proxy integration, though new projects should target the successor SSClash-Go instead.
Gargoyle is a third-party router firmware distribution based on OpenWrt/LEDE. It provides a comprehensive web-based administration interface with features such as bandwidth monitoring, QoS, VPN (OpenVPN, WireGuard, Tor), dynamic DNS, ad blocking, web monitoring, and a plugin system for extensibility. The codebase is a large collection of C utilities (custom netfilter match modules, a package manager 'gpkg', bandwidth accounting libraries, and a CGI framework built on a patched version of haserl), shell scripts for UCI configuration and firewall management, and JavaScript/CSS for the web UI. Internationalization is extensive with over a dozen language packs. The architecture is monolithic in the sense that all components are built as part of a firmware image, but modular at the package level. Key data flows involve kernel-level packet matching (via custom nftables/iptables modules) feeding user-space libraries (libiptbwctl/libnftbwctl) and shell scripts that expose bandwidth and status data through the web interface.