Network Security

SafeLine23.2k★

SafeLine is a self-hosted web application firewall: a reverse proxy that sits in front of your sites and blocks SQL injection, XSS, command injection, bots and HTTP floods before they reach your app. Chaitin Tech builds it, now selling it internationally as CyberServal, and the Personal edition is free forever for up to 10 apps. Setup is a root install script on a Linux box with Docker, then you add sites in a web console. The free and Lite editions run single-threaded, rated at about 800 requests per second. Fully open alternatives: Coraza with the OWASP Core Rule Set, or BunkerWeb. Pricing is public. Lite is $10/month or $100/year for 20 apps, geo-blocking and log export. Pro is $100/month or $1,000/year for unlimited apps, full multi-core performance, multiple admin users and load balancing, with a separate license per node. Solo: free. Small teams: free, or Lite past 10 sites. Larger teams: Pro, or Cloudflare WAF for edge DDoS protection. The catch: the GitHub repo isn't the whole product. The detection engine ships as a prebuilt image, so you can't audit what does the blocking. And CVE-2026-92749 let attackers forge admin logins on versions through 9.4.1. Run 9.4.2 or later.

CrowdSec15.5k★

CrowdSec analyzes your server logs, detects attack patterns, and shares threat intelligence with the community. Basically fail2ban on steroids with a global blocklist that everyone contributes to. MIT license, Go. It reads your logs (Nginx, SSH, WordPress, anything), detects attack patterns using community-written scenarios, and takes action: blocking IPs via your firewall, Cloudflare, AWS Security Groups, or a dozen other bouncers. The crowd-sourced threat intelligence means an IP that attacks someone else gets flagged before it hits you. Free tier: the Security Engine (detection + local decisions) is fully free. The community blocklist (crowd-sourced IP reputation) is free. Self-host everything. Paid: CrowdSec Console premium starts around $20/mo per server for advanced dashboards, custom blocklists, and priority threat feeds. Enterprise pricing is custom. Solo: install the free tier on your VPS, block 90% of automated attacks for $0. Small teams (2-10): free tier covers most needs. Pay $20/server/month when you want centralized dashboards across multiple servers. Large teams: enterprise plan for fleet management and custom threat feeds. The catch: CrowdSec depends on accurate log parsing. If your app logs in a non-standard format, you'll write custom parsers. And the community blocklist, while useful, can produce false positives. A shared hosting IP getting flagged because of one bad tenant affects everyone on that IP.

maltrail8.7k★

Maltrail watches network traffic for connections to known malicious destinations. It pulls public threat feeds (known C2 servers, malware domains, abuse lists) and alerts when a host on your network talks to one of them. Free, MIT-licensed. Setup is moderate. You point it at a network interface or feed it aggregated traffic from your firewall, and let it analyze passively. The web UI shows alerts grouped by severity. Tune the feeds for your environment because public lists generate false positives, especially around shared CDN ranges. For homelabs, small SOCs, and security-conscious dev teams, this is a real tool. It's not a full IDS. Suricata or Zeek do deeper packet inspection. But it answers the simple question: is anything on my network calling out to a known bad place. That's useful even if you also run something heavier. The catch is that it only catches what's already on a public blacklist. Targeted attacks using fresh infrastructure won't trip it. Treat it as one signal in a layered defense, not the whole defense.

coraza4.0k★

Coraza is a web application firewall engine: it inspects HTTP requests for SQL injection, XSS, and the rest of the attack alphabet before they reach your app. It's an OWASP project written in Go, fully compatible with ModSecurity's rule language and the OWASP Core Rule Set, and free under Apache 2.0. You don't run Coraza by itself; you embed it in a proxy. The mature paths are a Caddy build with the Coraza plugin or Envoy via proxy-wasm, then loading the Core Rule Set. The install is the easy half. The work is tuning: every real application trips false positives until you've spent quality time with exclusion rules. Solo and small teams wanting an appliance with a dashboard should use chaitin/SafeLine instead; Coraza has no UI. Platform and infrastructure teams get exactly what they want here: a maintained, embeddable WAF engine without betting on ModSecurity, whose corporate support ended and left it in maintenance mode. The catch: a WAF engine without tuned rules is a false-positive machine. Run it in detection-only mode against production traffic before you even think about blocking.

eth-phishing-detect1.3k★

This is MetaMask's phishing detection library. It maintains a blocklist of known phishing domains targeting crypto users and a fuzzy-matching algorithm that catches typosquatting attempts. You feed it a domain, it tells you if it's a known phishing site or looks suspiciously similar to a legitimate one. MetaMask uses it internally to warn users before they connect their wallet to a malicious site. The library itself is simple; it's the maintained blocklist that's valuable. Community-contributed and regularly updated as new phishing campaigns appear. The catch: this is narrowly focused on Web3/crypto phishing. It won't help with general phishing detection. The blocklist is only as current as the last update; zero-day phishing domains won't be caught until someone reports them. And the license is listed as 'Other'; check the repo for exact terms before integrating commercially.

littlesnitch-linux920★

Objective Development open-sourced the eBPF networking components behind Little Snitch, their macOS firewall, and brought them to Linux. This gives you kernel-level control over outbound network connections: monitor what your system talks to and block what you don't want. Setup is developer-grade. You need Rust, clang, and bpf-linker to build from source. Traffic filtering works through plain text blocklists (domains and hosts), and the web UI is minimal. This is not a consumer product yet. It's the engine room, published for people who know what eBPF is and why they want it. Security-conscious developers and sysadmins running Linux workstations are the audience. Anyone who wants kernel-level visibility into every outbound connection, and is comfortable building Rust projects, will feel right at home. The catch: GPL-2.0 covers the open source parts, but some components remain proprietary. No GUI to speak of, manual blocklist management, and the build process will filter out anyone who isn't already comfortable in a terminal.