Gateway

Gateway is a firewall, router and gateway software system that runs on x86-64 hardware. It runs on a standard FreeBSD installation or, for enhanced performance and stricter security, on a custom FreeBSD kernel optimized for the host hardware.

An overlay on FreeBSD

Unlike OPNsense and pfSense, Gateway is an overlay on FreeBSD rather than a separate distribution. It is completely compatible with FreeBSD’s ports system, so you can install and update additional software on your gateway in the same way as on any other FreeBSD system.

A hardened custom kernel

The optional custom kernel is built with only the drivers and features your hardware needs, all compiled into the kernel. That shrinks the attack surface, and restricts the loading or unloading of kernel modules.

Firewall technology

Gateway’s firewall is built on FreeBSD’s own packet filtering. The default is ipfw, FreeBSD’s native firewall. It provides stateful packet filtering, in-kernel NAT, and dummynet, which limits bandwidth and shapes traffic using pipes and queues. Rules are numbered and can be added, changed or removed individually while the firewall is running.

pf, the packet filter that originated in OpenBSD, is available as an option. It is always available with a standard FreeBSD kernel, and is an explicit build option with a custom kernel. It is stateful by default, uses a declarative rule file that is loaded as a whole, and has a syntax that is familiar to administrators who come from OpenBSD, OPNsense or pfSense.

Additional FreeGateway software

Gateway integrates other FreeGateway software:

• Yumei renews TLS certificates automatically.
• DynDNS gives a Gateway whose address is assigned by DHCP a DNS hostname that stays current.
• Antei monitors and manages the daemons that run on the Gateway.

System Dashboard

The FreeGateway Project rejects the security compromises of a web-based dashboard for critical infrastructure such as firewalls and gateways. Instead, we chose an advanced TUI (text-based user interface) for the Gateway, which gives most of the convenience of a web app without the security impacts. Access to the System Dashboard is via SSH, using only SSH certificates. It also runs on non-Gateway systems that run FreeGateway software.

Like every other FreeGateway project, Gateway is open source and runs on your own hardware.