Network Security

Pi-hole61.0k★

Pi-hole blocks ads at the network level before they ever reach your screen, covering every device on your network: phones, smart TVs, tablets, everything. Instead of installing ad blockers on each device, you point your router's DNS to a Pi-hole server and it filters ad domains for your entire network. community-driven, runs on a Raspberry Pi or any Linux box. It works as a DNS sinkhole: when a device tries to load an ad domain, Pi-hole returns nothing. You get a web dashboard showing every DNS query, which devices are chatty, and what's being blocked. Most users see 20-40% of all DNS queries blocked. Fully free. No paid tier, no premium features, no cloud version. Donations accepted but nothing is gated. Setup takes 30 minutes if you've never touched a command line. Ongoing ops: almost zero. It just runs. Updates are a single command. The only real maintenance is occasionally whitelisting a domain that got caught in a blocklist. Solo home users: install it, forget about it. Small offices: works great on a shared network. The catch: it can't block ads embedded in the same domain as content (like YouTube ads served from youtube.com). For that, you still need a browser extension like uBlock Origin. And if you misconfigure it, every device on your network loses DNS resolution, so don't experiment on a Friday night.

SafeLine22.7k★

SafeLine is a web application firewall (WAF) that sits in front of your servers and filters malicious requests: SQL injection, XSS, bot traffic, credential stuffing. It's a bouncer for your web traffic that inspects every request before it reaches your app. GPL v3, Go. Uses a semantic analysis engine (not just regex pattern matching) to detect attacks, which means lower false positives than traditional WAFs. Dashboard shows traffic stats, blocked threats, and lets you configure rules. Supports reverse proxy mode. Drop it in front of Nginx or any web server. The community edition is free. Docker install, configure your upstream servers, and it's running. Basic WAF protection, bot detection, rate limiting, and IP blocking included. A pro/enterprise version exists with advanced features like enhanced bot protection, API security, and priority support. Pricing isn't publicly listed. Contact sales. Solo developers: free community edition is solid for protecting personal projects and small apps. Small teams: free edition handles most threats. Medium to large: evaluate the pro version for advanced bot protection and API security, or consider Cloudflare WAF if you're already using their CDN. The catch: you're adding another hop in your request chain. Latency increases slightly. The community edition's rule set is less comprehensive than Cloudflare or AWS WAF. And the GPL v3 license means modifications must be open-sourced, which matters if you're integrating it deeply into proprietary infrastructure.

CrowdSec14.9k★

CrowdSec analyzes your server logs, detects attack patterns, and shares threat intelligence with the community. Basically fail2ban on steroids with a global blocklist that everyone contributes to. MIT license, Go. It reads your logs (Nginx, SSH, WordPress, anything), detects attack patterns using community-written scenarios, and takes action: blocking IPs via your firewall, Cloudflare, AWS Security Groups, or a dozen other bouncers. The crowd-sourced threat intelligence means an IP that attacks someone else gets flagged before it hits you. Free tier: the Security Engine (detection + local decisions) is fully free. The community blocklist (crowd-sourced IP reputation) is free. Self-host everything. Paid: CrowdSec Console premium starts around $20/mo per server for advanced dashboards, custom blocklists, and priority threat feeds. Enterprise pricing is custom. Solo: install the free tier on your VPS, block 90% of automated attacks for $0. Small teams (2-10): free tier covers most needs. Pay $20/server/month when you want centralized dashboards across multiple servers. Large teams: enterprise plan for fleet management and custom threat feeds. The catch: CrowdSec depends on accurate log parsing. If your app logs in a non-standard format, you'll write custom parsers. And the community blocklist, while useful, can produce false positives. A shared hosting IP getting flagged because of one bad tenant affects everyone on that IP.

maltrail8.6k★

Maltrail watches network traffic for connections to known malicious destinations. It pulls public threat feeds (known C2 servers, malware domains, abuse lists) and alerts when a host on your network talks to one of them. Free, MIT-licensed. Setup is moderate. You point it at a network interface or feed it aggregated traffic from your firewall, and let it analyze passively. The web UI shows alerts grouped by severity. Tune the feeds for your environment because public lists generate false positives, especially around shared CDN ranges. For homelabs, small SOCs, and security-conscious dev teams, this is a real tool. It's not a full IDS. Suricata or Zeek do deeper packet inspection. But it answers the simple question: is anything on my network calling out to a known bad place. That's useful even if you also run something heavier. The catch is that it only catches what's already on a public blacklist. Targeted attacks using fresh infrastructure won't trip it. Treat it as one signal in a layered defense, not the whole defense.

coraza3.8k★

Coraza is a web application firewall engine: it inspects HTTP requests for SQL injection, XSS, and the rest of the attack alphabet before they reach your app. It's an OWASP project written in Go, fully compatible with ModSecurity's rule language and the OWASP Core Rule Set, and free under Apache 2.0. You don't run Coraza by itself; you embed it in a proxy. The mature paths are a Caddy build with the Coraza plugin or Envoy via proxy-wasm, then loading the Core Rule Set. The install is the easy half. The work is tuning: every real application trips false positives until you've spent quality time with exclusion rules. Solo and small teams wanting an appliance with a dashboard should use chaitin/SafeLine instead; Coraza has no UI. Platform and infrastructure teams get exactly what they want here: a maintained, embeddable WAF engine without betting on ModSecurity, whose corporate support ended and left it in maintenance mode. The catch: a WAF engine without tuned rules is a false-positive machine. Run it in detection-only mode against production traffic before you even think about blocking.

eth-phishing-detect1.3k★

This is MetaMask's phishing detection library. It maintains a blocklist of known phishing domains targeting crypto users and a fuzzy-matching algorithm that catches typosquatting attempts. You feed it a domain, it tells you if it's a known phishing site or looks suspiciously similar to a legitimate one. MetaMask uses it internally to warn users before they connect their wallet to a malicious site. The library itself is simple; it's the maintained blocklist that's valuable. Community-contributed and regularly updated as new phishing campaigns appear. The catch: this is narrowly focused on Web3/crypto phishing. It won't help with general phishing detection. The blocklist is only as current as the last update; zero-day phishing domains won't be caught until someone reports them. And the license is listed as 'Other'; check the repo for exact terms before integrating commercially.

littlesnitch-linux908★

Objective Development open-sourced the eBPF networking components behind Little Snitch, their macOS firewall, and brought them to Linux. This gives you kernel-level control over outbound network connections: monitor what your system talks to and block what you don't want. Setup is developer-grade. You need Rust, clang, and bpf-linker to build from source. Traffic filtering works through plain text blocklists (domains and hosts), and the web UI is minimal. This is not a consumer product yet. It's the engine room, published for people who know what eBPF is and why they want it. Security-conscious developers and sysadmins running Linux workstations are the audience. Anyone who wants kernel-level visibility into every outbound connection, and is comfortable building Rust projects, will feel right at home. The catch: GPL-2.0 covers the open source parts, but some components remain proprietary. No GUI to speak of, manual blocklist management, and the build process will filter out anyone who isn't already comfortable in a terminal.