AiFw

High-performance firewall for FreeBSD built in Rust on top of pf. Optional AI/ML threat detection. All features free and open source.

AI is not required. AiFw is a full-featured firewall, router, DHCP server, DNS resolver, IDS/IPS, reverse proxy, and NTP server that works perfectly without any AI features enabled. You get stateful packet filtering, NAT, VPN, Geo-IP blocking, Suricata-compatible intrusion detection, traffic shaping, and a complete web UI — all without AI. There is no cloud dependency and no telemetry.

AI/ML features are a work in progress. The aifw-ai crate contains experimental detectors for port scans, DDoS, brute force, C2 beacons, and DNS tunneling. These are not yet production-ready and are disabled by default. The AI module is an opt-in add-on that will be developed further in future releases. The Threats page in the UI reflects the current WIP status of this module.

Screenshots

Live Demos

Demo	Preview
Dashboard — live metrics, charts, health status
Firewall Rules — browsing rule table
Blocked Traffic — real-time feed
Connections — live state table
IDS/IPS — engine overview and stats

All 20 screenshots

#	Page	Screenshot
1	Dashboard
2	Traffic Analytics
3	Firewall Rules
4	NAT / Port Forward
5	Blocked Traffic
6	Live Connections
7	IDS Dashboard
8	IDS Rulesets
9	DNS Resolver
10	DHCP Server
11	DHCP Subnets
12	Interfaces
13	VPN (WireGuard/IPsec)
14	Geo-IP Filtering
15	Reverse Proxy
16	Time Service (NTP)
17	User Management
18	Roles & Permissions
19	Settings
20	System Updates

Features

• Stateful packet filtering via FreeBSD's pf with anchor isolation
• NAT — SNAT, DNAT/RDR, masquerade, binat (NAT64/NAT46 in development — rule types exist, cross-family translation data plane is being built, #531)
• Connection tracking — real-time state table monitoring, top talkers, protocol breakdown
• Rate limiting & traffic shaping — HFSC/PriQ queues, per-IP overload tables, SYN flood protection (CoDel via dummynet FQ-CoDel in development, #532)
• AI/ML threat detection (optional, WIP) — experimental port scan, DDoS, brute force, C2 beacon, DNS tunnel detection with auto-response (disabled by default, not yet production-ready)
• VPN integration — WireGuard tunnels + peers, and IKEv2 site-to-site IPsec (tunnel mode, PSK or X.509 auth, NAT-T) powered by strongSwan
• Geo-IP filtering — country-based block/allow with GeoLite2 CSV, CIDR aggregation
• TLS inspection — JA3/JA3S fingerprinting, SNI filtering, cert validation, version enforcement
• Plugin system — native Rust + WASM sandboxed plugins with 7 hook points
• High availability (active-passive pair) — Two AiFw nodes share a CARP virtual IP and pfsync state. Reboot the master and TCP sessions survive on the standby with no operator intervention. Setup via the UI in <15 minutes. See docs/ha.md for setup, ops, and failure modes.
• Metrics engine — RRD-style ring buffers (1s/1m/1h/1d tiers), optional PostgreSQL backend
• REST API — Axum with JWT auth, API keys, full CRUD for all resources
• Terminal UI — ratatui dashboard with 5 tabs
• Web UI — NextJS with 11 pages, real-time charts, dark theme

Architecture

AiFw/
├── aifw-common/        # Shared types (rules, NAT, VPN, TLS, geo-IP, HA, metrics)
├── aifw-pf/            # pf backend trait + mock (Linux) / ioctl (FreeBSD)
├── aifw-core/          # Engines: rules, NAT, VPN, TLS, geo-IP, HA, shaping, audit
├── aifw-conntrack/     # Connection tracking, pflog parsing, stats
├── aifw-plugins/       # Plugin framework (native + WASM) + 3 example plugins
├── aifw-ai/            # ML threat detection (5 detectors) + auto-response [WIP]
├── aifw-metrics/       # RRD ring buffer metrics engine
├── aifw-api/           # Axum REST API server (JWT + API key auth)
├── aifw-tui/           # ratatui terminal UI
├── aifw-daemon/        # Main firewall daemon
├── aifw-cli/           # CLI tool
└── aifw-ui/            # NextJS web interface

Design Principles

• pf anchors — AiFw rules live in dedicated pf anchors, never touching system pf config
• Trait-based pf abstraction — PfBackend trait with mock (Linux dev) and ioctl (FreeBSD) implementations
• Async everywhere — Tokio runtime throughout
• SQLite storage — rules, config, audit logs persisted via sqlx
• No paid crates — all dependencies are free and open source

Quick Start

# Build
cargo build --release

# Initialize database
aifw init --db /var/db/aifw/aifw.db

# Start the daemon
aifw-daemon --db /var/db/aifw/aifw.db --interface em0

# Start the API server
aifw-api --db /var/db/aifw/aifw.db --listen 0.0.0.0:8080

# Start the TUI
aifw-tui --db /var/db/aifw/aifw.db

# Start the web UI
cd aifw-ui && npm install && npm run dev

CLI Usage

# Rules
aifw rules add --action pass --direction in --proto tcp --dst-port 443 --label "allow-https"
aifw rules add --action block --direction in --proto tcp --dst-port 22 --src 10.0.0.0/8
aifw rules list
aifw rules remove <uuid>

# NAT
aifw nat add --type snat --interface em0 --src 192.168.1.0/24 --redirect 203.0.113.1
aifw nat add --type dnat --interface em0 --proto tcp --dst-port 80 --redirect 192.168.1.10 --redirect-port 8080
aifw nat list

# Rate limiting
aifw ratelimit add --name ssh-protect --proto tcp --max-conn 5 --window 30 --table bruteforce --dst-port 22
aifw queue add --name voip --interface em0 --type priq --bandwidth 100Mb --class voip

# VPN
aifw vpn wg-add --name wg0 --interface wg0 --port 51820 --address 10.0.0.1/24
aifw vpn wg-peer-add --tunnel <id> --name laptop --pubkey <key> --endpoint 1.2.3.4:51820
aifw vpn ipsec-add --name office --remote 198.51.100.1 --psk <secret> --local-ts 10.0.0.0/24 --remote-ts 10.1.0.0/24

# Geo-IP
aifw geoip add --country CN --action block
aifw geoip add --country US --action allow
aifw geoip lookup 1.2.3.4

# Status & reload
aifw status
aifw reload

REST API

All endpoints under /api/v1/ with JWT Bearer or ApiKey authentication.

Method	Endpoint	Description
POST	/auth/login	Get JWT token
POST	/auth/users	Create user
POST	/auth/api-keys	Create API key
GET/POST	/rules	List / create rules
GET/DELETE	/rules/{id}	Get / delete rule
GET/POST	/nat	List / create NAT rules
DELETE	/nat/{id}	Delete NAT rule
GET	/status	Firewall status
GET	/connections	Live connection table
POST	/reload	Reload all rules into pf
GET	/metrics	System metrics
GET	/logs	Audit log

Web UI

NextJS application with 11 pages:

• Dashboard — key metrics, sparkline charts, protocol/threat breakdowns
• Traffic — bandwidth, PPS, bytes with time range selector (5m–30d)
• Rules / NAT — full CRUD with inline forms
• Connections — auto-refreshing live state table
• Threats — AI detection timeline, severity scoring, auto-response history (WIP — AI module is experimental)
• Geo-IP — country rules, IP lookup
• VPN — WireGuard tunnels + peers, IKEv2 IPsec site-to-site tunnels
• Cluster — CARP VIPs, pfsync, node health, health checks
• Logs — filterable audit log with color-coded actions
• Settings — metrics backend (local/PostgreSQL), API, TLS policy

Development

Development happens in WSL/Linux. The mock pf backend enables full compilation and testing without FreeBSD.

cargo build          # Build all Rust crates
cargo test           # Run all 216 tests
cargo check          # Fast type check

cd aifw-ui
npm install          # Install UI dependencies
npm run dev          # Start dev server on :3000

The toolchain is pinned in rust-toolchain.toml (stable, with rustfmt + clippy) and formatting in rustfmt.toml, so every contributor and CI run use the same compiler and style. After cloning, install the git hooks once:

sh scripts/install-hooks.sh   # pre-commit runs fmt --check + clippy -D warnings

The hook mirrors CI's fast gates; skip a single run with git commit --no-verify.

Target Environment

• OS: FreeBSD 15.x
• Kernel: GENERIC with pf enabled
• Required: /dev/pf accessible (root or dedicated group)
• pf: pf_enable="YES" in /etc/rc.conf

License

MIT — all features free and open source.