meiandClaude Opus 5
f7ad3aac95
The rule editor no longer requires writing expr by hand. Conditions are rows of field + operator + values joined with AND or OR, each row negatable, and the generated expression is shown live and validated by the engine before a rule is accepted. Raw expression and YAML editing are still available. Fields cover the connection (protocol, source/destination IP and port), domains (TLS SNI, QUIC SNI, DNS query name), HTTP (host, path, method, User-Agent) and protocol detection. Operators cover CIDR membership, GeoIP countries, GeoSite categories, port ranges, wildcards, substrings and regular expressions. Multiple values in a row are OR-ed, so one row holds a whole domain or country list. Wildcards compile to the cheapest expression that matches them: *.x.com becomes endsWith, x.* startsWith, *ad* contains, and only a star in the middle falls back to a regular expression. Values are validated as they are typed, including a hint when a star is used with an operator that would match it literally. Country and category pickers are backed by the databases the engine actually loaded, via a new GET /api/v1/geo endpoint (cached, loaded on demand) built on new listing methods in the geo package. Country names and flags come from Intl.DisplayNames, so no name table is shipped. Note that the v2geo format has no AS numbers; the provider groups it does contain (cloudflare, google, telegram, ...) are listed alongside the countries. Opening an existing rule parses its expression back into conditions. Anything the builder cannot represent opens in the expression editor with a warning rather than being rewritten. ruleset/expr_test.go pins the canonical expressions the builder generates and compiles them with the real engine, and the devserver now uses the real ruleset compiler so the same errors show up during frontend work. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2.9 KiB
OpenGFW is your very own DIY Great Firewall of China (https://en.wikipedia.org/wiki/Great_Firewall), available as a flexible, easy-to-use open source program on Linux. Why let the powers that be have all the fun? It's time to give power to the people and democratize censorship. Bring the thrill of cyber-sovereignty right into your home router and start filtering like a pro - you too can play Big Brother.
Documentation site: https://gfw.dev/
Telegram group: https://t.me/OpGFW
Caution
This project is still in very early stages of development. Use at your own risk. We are looking for contributors to help us improve and expand the project.
Features
- Full IP/TCP reassembly, various protocol analyzers
- HTTP, TLS, QUIC, DNS, SSH, SOCKS4/5, WireGuard, OpenVPN, and many more to come
- "Fully encrypted traffic" detection for Shadowsocks, VMess, etc. (https://gfw.report/publications/usenixsecurity23/en/)
- Trojan (proxy protocol) detection
- [WIP] Machine learning based traffic classification
- Full IPv4 and IPv6 support
- Flow-based multicore load balancing
- Connection offloading
- Powerful rule engine based on expr
- Hot-reloadable rules (send
SIGHUPto reload) - Flexible analyzer & modifier framework
- Extensible IO implementation (only NFQueue for now)
- Web UI with live traffic dashboard and rule editor
Web UI
OpenGFW ships with an optional web dashboard: live traffic statistics, a real-time event feed with per-stream analyzer properties, and a rule editor that validates and hot reloads the ruleset. It works on phones as well as on desktops.
Rules can be written as a list of conditions — pick a field (SNI, DNS name, HTTP host, IP, port, detected protocol), an operator (wildcard, CIDR, GeoIP country, GeoSite category, range, regex) and one or more values — or as raw expr expressions and YAML. Countries and site categories are picked from the geo databases the engine loaded.
Enable it in your config file:
web:
enabled: true
listen: :8080
secret: your-password-here # generated and logged on startup if left empty
# cert: /path/to/fullchain.pem
# key: /path/to/privkey.pem
The UI is embedded in the binary, so no extra files need to be deployed. Only expose it to trusted networks — anyone with the password can change your rules. See web/README.md for development instructions.
Use cases
- Ad blocking
- Parental control
- Malware protection
- Abuse prevention for VPN/proxy services
- Traffic analysis (log only mode)
- Help you fulfill your dictatorial ambitions