Goblin Gate 0.1.0-beta.10

Fixes from the first days on beta.9, and a sweep through the whole web UI.

Fixed

• Bandwidth by interface no longer shows old traffic under "none": traffic stored before beta.9 gets
  its interface filled in once when Goblin Gate starts, and a WAN that gets its address by DHCP is
  recognised too.
• Goblin Checks no longer says "Goblin Gate … is available" when only a plugin is behind; it names the
  plugin update instead. Dismissing "Restart needed" no longer hides every later restart, and the finding
  points to the account menu, where the restart is.
• Tailscale settings are loaded from your saved configuration. Before, the form reset every few seconds
  while you typed, and saving could blank Accept DNS, Login Server and Allow Access. A connected node shows
  as Connected.
• NTP and DNS servers (System → General): you can type a second server again (Enter and commas work).
• Commit bar says the commit was confirmed after you click Confirm, instead of "rolled back".
• Blocking an address on your own network (Devices, Sentry blocks): the "block anyway" checkbox now
  appears when it is needed.
• Devices → Create address object opens a new address filled in with the device's IP.
• Failed saves keep the form open with the error, instead of closing it and losing your edits.
• Templates: a day you picked can be unpicked. Custom rules: Check no longer leaves the rule in
  your pending changes.
• WireGuard peer configs download with their proper file name.
• Layout fixes on phones and small screens (Security, chart builder, packet capture, incidents and others),
  dark mode fixes for warning boxes and badges, and the theme button shows the current theme.

Improved

• SSH keys (System → Admins): a proper, labelled field for the public key, with help on which file to
  paste and how to make one. A pasted private key or a key type that isn't supported is caught before
  saving, and the list shows each key's type and comment.
• Deleting admins, API tokens, SSH keys, DHCP servers, static routes and port forwards asks first.
• Errors that used to be swallowed are now shown: Tailscale, Dynamic DNS Update now, sign-out of
  sessions, CrowdSec, Sentry queue answers.
• The two-factor login step has a way back to username and password; packet capture can start a new
  capture; Dynamic DNS has Update now; the policy simulator opens matched policies directly.

Upgrading

Boxes on the beta channel see this version within 6 hours (System → Updates, or apt-get update && apt-get install goblin-gate goblin-gate-plugin-sentry as root). Updating needs no reboot.

Try it without installing

docker run --rm -p 127.0.0.1:8090:8090 ghcr.io/mostlywithinspec/goblin-gate-demo

Then open http://localhost:8090.

Install

Download goblin-gate-0.1.0-beta.10-amd64.iso below, boot it (BIOS or UEFI, Secure Boot works), pick the
disk, and open https://<LAN address> to run the setup wizard.

Goblin Gate 0.1.0-beta.9

Fixes from the first days on beta.8, and another round of hardening.

Fixed

• Plugins update with Goblin Gate. The updater only ever updated Goblin Gate itself, so first-party
  plugins (Goblin Sentry) stayed at the version first installed. They now update and roll back together
  with it, and a box where only a plugin is behind is offered the update (System → Updates lists it).
• Bandwidth by interface no longer shows traffic under "none": traffic seen by the IPS now gets the
  interface whose network it came from.
• WAN status works on a single-WAN box: it shows the WAN's link, address and the gateway it uses,
  instead of "no gateways are configured".
• Policy hit leaderboard shows each policy's name next to its number.

New

• Restart from the web UI: your name at the top right is now a menu with Log out and Restart Goblin
  Gate…, which asks before it restarts (admins only).

Security

• Updated Go dependencies (golang.org/x/net, golang.org/x/crypto): a vulnerability scan of this release
  finds no known issues.
• Tighter limits on what a stored password hash may cost to check.
• Stricter checks on static file paths, event stream names, custom rule strings and the Tailscale login
  link.

Upgrading

Boxes on the beta channel see this version within 6 hours (System → Updates, or apt-get update && apt-get install goblin-gate goblin-gate-plugin-sentry as root). Updating needs no reboot.

Try it without installing

docker run --rm -p 127.0.0.1:8090:8090 ghcr.io/mostlywithinspec/goblin-gate-demo

Then open http://localhost:8090.

Install

Download goblin-gate-0.1.0-beta.9-amd64.iso below, boot it (BIOS or UEFI, Secure Boot works), pick the
disk, and open https://<LAN address> to run the setup wizard.

Goblin Gate 0.1.0-beta.8

A hardening release: no new features, a tighter box. Recommended for everyone on the beta channel.

Try it without installing

A demo image now comes with every release: Goblin Gate's web UI on a pretend home network, in one command.
Nothing in it is real and nothing leaves the container.

docker run --rm -p 127.0.0.1:8090:8090 ghcr.io/mostlywithinspec/goblin-gate-demo

Then open http://localhost:8090.

Security

These come from a security review of a production Goblin Gate before 0.1.0. None of them was a way in;
each makes an attacker's job harder.

• Login throttling is stronger against clients that keep changing their address, and an admin who
  recently logged in from a device can't be kept out by someone else failing logins for that user.
• Web UI headers: a strict Content Security Policy and HSTS.
• TLS: TLS 1.2 now offers only modern, forward-secret cipher suites (TLS 1.3 is unchanged).
• SSH: port forwarding is limited to reaching the web UI on the box itself (ssh -L to the admin page
  still works).
• Service sandboxes: the firewall log collector and the UPS services (NUT) now run in systemd sandboxes
  like the DNS, DHCP and IPS services.

Upgrading

Boxes on the beta channel see this version within 6 hours (System → Updates, or apt-get update && apt-get install goblin-gate goblin-gate-plugin-sentry as root). Updating needs no reboot; the log collector
restarts once to enter its sandbox.

If you use SSH port forwarding to reach other hosts through the box, that no longer works: use WireGuard or
Tailscale for that.

Install

Download goblin-gate-0.1.0-beta.8-amd64.iso below, boot it (BIOS or UEFI, Secure Boot works), pick the
disk, and open https://<LAN address> to run the setup wizard.

Goblin Gate 0.1.0-beta.7

The last feature beta before 0.1.0: Goblin Checks, templates for common setups, UPS support, OPNsense import, ET Pro rules, and two update channels.

New

• Goblin Checks (Goblin Checks in the menu, and a dashboard widget): an audit of your setup that lists
  what is risky or forgotten, most important first, each with a plain explanation and a link to the page
  that fixes it. Admin pages open on the internet, port forwards open to everyone (worse for SSH, RDP and
  databases), any-to-any policies from the WAN, admins without two-factor login, no config history off the
  box, security updates off, a pending restart and more. The score only counts real findings; dismiss the
  ones that are deliberate. See the Goblin Checks
  wiki page for every check.
• Templates (Policy & Objects → Templates): a guest network, an IoT network, a port forward for some
  places only ("Plex only from home"), a network through a VPN provider with a kill switch, and a bedtime for
  the kids' devices. Answer a few questions, preview the changes, apply them to the candidate, commit.
• UPS support (System → UPS and a dashboard widget): a UPS on the box's USB port, or one a NAS or server
  already watches with NUT. Notifications when the power goes and comes back, and a clean shutdown when the
  battery runs low, at your own threshold if you like.
• Import from OPNsense (System → Import): the importer now reads OPNsense backups too, the older and the
  newer formats (firewall rules, aliases including GeoIP, outbound NAT, gateways, Kea or dnsmasq DHCP,
  Unbound). Password hashes, API keys, two-factor seeds, certificates, keys and alias credentials are never
  imported.
• ET Pro rules (Security → IPS): paste an ET Pro subscription code to use ET Pro instead of ET Open.

Changed

• Two update channels: stable and beta. There is no nightly channel any more: every build in either
  channel has been through the full test run. Beta is the feature channel. A box that followed nightly now
  follows beta.
• pfSense import: disabled gateways and static routes are no longer imported as active, and manual
  outbound NAT rules are listed one by one in the report.

Security

• A live event stream now ends when its API token is revoked or expires, its session ends, or its user is
  deleted. Before, an open stream kept receiving events.
• The UPS (NUT) configuration files, which hold its passwords, are readable only by root and NUT. Copies Goblin
  Gate keeps while applying a change are readable only by root.
• The generated-config viewer hides NUT passwords; the ET Pro code never appears in logs, errors or on a
  command line.

See the wiki for setup details.

Upgrading

Boxes on the beta channel see this version within 6 hours (System → Updates, or apt-get update && apt-get install goblin-gate goblin-gate-plugin-sentry as root). Updating needs no reboot. NUT (for UPS support) is
installed with the ISO; on an updated box, apt-get install nut-client nut-server adds it.

Install

Download goblin-gate-0.1.0-beta.7-amd64.iso below, boot it (BIOS or UEFI, Secure Boot works), pick the
disk, and open https://<LAN address> to run the setup wizard.

Goblin Gate 0.1.0-beta.6

Power-user features: your own nftables rules, a CrowdSec bouncer, API tokens limited to what a script needs, a live event stream, global search, and a UI that works on a phone.

New

• Custom nftables rules (Policy & Objects → Custom Rules): for the few things policies can't express, add
  your own nftables rules to the input, forward, output or NAT hooks, before or after the generated ones. Each
  rule is checked with nft before a commit, an error points at the rule that caused it, and every rule gets
  a hit counter. A warning on the page reminds you that a custom rule can lock you out; the usual
  commit/confirm rollback still applies.
• CrowdSec bouncer (Security → CrowdSec): point Goblin Gate at your CrowdSec instance (LAPI URL and a
  bouncer key from cscli bouncers add goblin-gate) and its ban decisions are dropped at the firewall, on the
  WAN only or on every interface. The page shows whether it is connected, how many decisions are active and
  how many packets were dropped.
• Limited API tokens (System → API Tokens): give a token only the scopes a script needs (read,
  write:firewall, write:network, write:system, actions, commit), an expiry date and the networks it may be
  used from. Presets for "Read only" and "Home automation" cover the common cases. Tokens with scopes can never
  see secrets.
• Live events (Log & Report → Live Events, and GET /api/v1/events as Server-Sent Events): commits,
  logins, rollbacks, WAN up/down, blocks and new devices as they happen. Read-only tokens can follow the stream
  too, e.g. from Home Assistant.
• Global search (Ctrl+K or the search button): jump to any page, policy, address, service, port forward,
  custom rule and more; object results open straight into their edit drawer.
• Phone layout: the menu becomes a slide-in drawer on small screens, the commit bar stays one tap away,
  wide tables scroll inside their box, edit drawers take the full width and forms stack to one column.

Security

• A limited token can't read or write secrets: when it saves a section, stored secrets are kept only for
  entries it did not otherwise change.
• Custom rules may not use flush, delete, table or similar commands that would reach beyond the rule
  itself, and can't contain ; or comments that hide a second statement.
• CrowdSec errors never include the bouncer key.

See the wiki for setup details.

Upgrading

Boxes on the beta channel see this version within 6 hours (System → Updates, or apt-get update && apt-get install goblin-gate goblin-gate-plugin-sentry as root). Updating needs no reboot.

Install

Download goblin-gate-0.1.0-beta.6-amd64.iso below, boot it (BIOS or UEFI, Secure Boot works), pick the
disk, and open https://<LAN address> to run the setup wizard.

Goblin Gate 0.1.0-beta.5

Country rules, config history in git, log export, and a hardened Linux base underneath.

New

• Country rules (GeoIP) (Network → Addresses, type Country): match traffic by country in policies and
  address groups, e.g. block a country from your LAN. The free DB-IP Lite database (CC BY
  4.0) downloads the first time you use a country and refreshes monthly. If it can't be downloaded, the commit
  is refused rather than leaving country rules matching nothing.
• Allowed sources on port forwards (Network → Port Forwards): limit a forward to some addresses or
  countries, e.g. your Plex server only from home. Imported pfSense forwards keep their source restriction; a
  forward whose source can't be converted is skipped instead of being opened to everyone.
• Config history in git (System → Backup): every commit is pushed to your own GitHub or Gitea repository
  over SSH with a deploy key the box creates. Password hashes, two-factor secrets and tokens are left out. The
  server's host key is pinned on the first push, and a push never overwrites commits made elsewhere.
• Log export (Log & Report → Export): send traffic, IPS, DNS, web filter and system logs to a syslog
  server (UDP, TCP or TLS) or to Grafana Loki.
• Automatic security updates, on by default: Debian security fixes install nightly. Only the security
  archive installs on its own; Goblin Gate updates stay under your control (System → Updates, where the
  setting is too). A "Restart needed" badge shows when a kernel update waits for a reboot.

Security

• Anti-spoofing: packets on the WAN that claim to come from your own networks, and packets on a LAN that
  don't belong to it, are dropped.
• Sandboxed services: the IPS no longer runs as root, and the DNS server, DHCP server, IPS and the
  firewall daemon run in systemd sandboxes (read-only system, only the capabilities they need).
• Kernel and SSH settings: ICMP redirects and source routing are off, kernel pointers are hidden from
  users, and SSH uses only modern MACs with agent forwarding off.
• Config history and log files are readable by root only.
• Credentials in a Loki URL are refused; they go in the username/password or token fields, which read-only
  users can't see.

See the wiki for setup details.

Upgrading

Boxes on the beta channel see this version within 6 hours (System → Updates, or apt-get update && apt-get install goblin-gate goblin-gate-plugin-sentry as root). Updating needs no reboot. DNS and DHCP restart once
to enter their sandboxes, which takes a second.

Install

Download goblin-gate-0.1.0-beta.5-amd64.iso below, boot it (BIOS or UEFI, Secure Boot works), pick the
disk, and open https://<LAN address> to run the setup wizard.

Goblin Gate 0.1.0-beta.4

Two-factor login, smart queue for a lag-free connection under load, dynamic DNS and network diagnostics.

New

• Two-factor login (System → Administrators → Two-factor authentication): protect your account with a code from any
  authenticator app (Google Authenticator, Authy, 1Password, Bitwarden...). Each code works once. If you lose
  your phone, goblin --set-password on the console resets the password and turns two-factor off.
• Active sessions (System → Administrators): see where you are signed in and sign out other browsers.
• Smart queue (Network → Interfaces, on a WAN): CAKE traffic shaping in both directions keeps games and
  calls smooth while something else fills the line. Set the speeds to about 90 % of what your line really
  does. Takes effect on commit, no reboot.
• Dynamic DNS (Network → Dynamic DNS): keeps a hostname pointing at your public IP with Cloudflare,
  DuckDNS or any provider with an HTTPS update URL. Checked every 5 minutes; an "Update now" button pushes
  right away.
• Diagnostics (System → Diagnostics): ping, traceroute and DNS lookup run from the firewall itself, with a
  choice of source interface.
• Wake-on-LAN (Network → Devices): wake a device with one click.
• DNS rebinding protection, on by default: public names can no longer answer with private addresses, so a
  malicious website can't use your browser to reach devices on your network. Names you forward to your own
  DNS servers and your local domain are exempt; a checkbox on Network → DNS turns it off.

Security

• Dynamic DNS tokens are hidden from read-only users and plugins like the other secrets, and are never shown
  in error messages.

See the wiki for setup details.

Upgrading

Boxes on the beta channel see this version within 6 hours (System → Updates, or apt-get update && apt-get install goblin-gate goblin-gate-plugin-sentry as root). Updating needs no reboot, and existing connections
stay up.

Install

Download goblin-gate-0.1.0-beta.4-amd64.iso below, boot it (BIOS or UEFI, Secure Boot works), pick the
disk, and open https://<LAN address> to run the setup wizard.

Goblin Gate 0.1.0-beta.3

Tools for seeing what is on your network and what the firewall does with it, plus security fixes. Updating
is recommended for everyone, above all if you have read-only admins or API tokens.

Security

• Read-only users and read-only API tokens could see secrets. The config, the pending-changes diff
  and backups included the admins' password hashes, notification credentials (webhook URLs, bot tokens,
  SMTP passwords) and threat feed download headers. A read-only account could crack a hash offline and
  become an admin. These are now hidden from read-only users and plugins, and backups are admins only.
  If you have read-only admins or read-only tokens you don't fully trust, change the admin passwords and
  rotate those credentials after updating.
• The Tailscale login link is admins only. While Tailscale waited for a login, read-only users could see
  the link; whoever opens it adds the box to their own tailnet.
• DHCP clients can no longer register wpad, isatap, teredo, localhost or the box's own name in
  DNS. A device naming itself wpad could have become the proxy for browsers that auto-detect one.
• WireGuard endpoints are checked strictly (host:port for VPN providers, a DNS name or IP for your own
  server), so no stray characters reach the files they are written to.
• The web UI sends X-Frame-Options, X-Content-Type-Options and Referrer-Policy headers; SSH X11
  forwarding is off; restoring a crafted backup can no longer use unbounded memory; the web filter's
  "continue anyway" only returns to the warned site.

New

• Devices (Network → Devices): everything on the network with IP, MAC, vendor, interface and last seen;
  give devices names that show up in logs and live traffic.
• Policy simulator (Policy & Objects → Simulate): which policy a connection would hit, without sending
  traffic. Denied connections in Log & Report have a "Why was this denied?" button.
• Packet capture (Log & Report → Packet capture): capture on any interface with filters, watch live,
  download a pcap for Wireshark.
• Live traffic (Log & Report → Live): top devices by bandwidth and their open connections.
• Generated config (System → Generated config): the files written for nftables, DHCP, DNS and IPS, with a
  diff of pending changes.
• Snapshots (System → Snapshots): save a named config, experiment, load it back. Included in backups.
• Commit with automatic rollback in the commit dialog: risky changes undo themselves unless you confirm.
• Prometheus metrics at /metrics (System → General → Metrics, off by default) and a Grafana dashboard
  in docs/grafana/goblin-gate.json.

Fixes

• The DHCP page shows the active leases (it was always empty).
• Stop capture, Forget device and Unblock IP no longer show an error after they worked.

See the wiki for how to use the new tools.

Upgrading

Boxes on the beta channel see this version within 6 hours (System → Updates, or apt-get update && apt-get install goblin-gate goblin-gate-plugin-sentry as root). Updating needs no reboot, and existing connections
stay up.

Install

Download goblin-gate-0.1.0-beta.3-amd64.iso below, boot it (BIOS or UEFI, Secure Boot works), pick the
disk, and open https://<LAN address> to run the setup wizard.

Goblin Gate 0.1.0-beta.2

Fixes from the first week of running Goblin Gate as a home firewall in place of pfSense.

Fixes

• Deleting an object that is still in use is refused, with the reason. Deleting an address, group,
  service, schedule, threat feed or security profile that a policy (or a group or DNS filter profile) still
  uses used to succeed, and the next commit then failed. Now the page says what still uses it, for example
  "Kids_Devices" is still used by policy 14 "wifi-rule-14". Remove it there first., and every delete asks
  for confirmation first.
• Commit errors name the policy. A policy problem now reads
  policy 14 "wifi-rule-14": unknown src_addr reference "Kids_Devices" (deleted or renamed?) instead of
  pointing at policies[11].
• Firewall Policy: the row actions are always visible. The ⋮ menu (clone, insert, disable, delete) stays
  pinned to the right edge of a wide table, and its menu is no longer cut off by the table's scroll area.
• IPS uses no more queues than the box has CPU cores (at most 4 per profile). On a 2-core box Suricata
  warned that it ran more queues than cores, which slows it down.
• A domain list set up as an IP threat feed says so. pfBlockerNG often lists hosts files as IP lists;
  such a feed used to fail with "no valid entries". It now says how many domain names it found and that it
  should be a domain feed used in a DNS filter profile.
• pfSense import: IPv6 tracking without upstream IPv6 stays off. When a LAN tracked a WAN that had no
  IPv6 in pfSense, the import turned DHCPv6 on for the WAN; with an ISP that offers no IPv6 the LAN then
  waited for a prefix forever. IPv6 is now left off, as it was in pfSense in effect, and the report says how
  to turn it on.
• The "wait for network" step at boot no longer shows as a failed service when no link is up yet (first boot
  before setup, WAN cable unplugged); services start either way.

Upgrading

Boxes on the beta channel see this version within 6 hours (System → Updates, or apt-get update && apt-get install goblin-gate goblin-gate-plugin-sentry as root).

Install

Download goblin-gate-0.1.0-beta.2-amd64.iso below, boot it (BIOS or UEFI, Secure Boot works), pick the
disk, and open https://<LAN address> to run the setup wizard.

Goblin Gate 0.1.0-alpha.3

Third alpha of Goblin Gate. This is still test software: try it in a VM or on a spare box first, and keep
your old firewall's config at hand.

Highlights

• Import from pfSense. System → Import takes a pfSense config.xml backup and turns it into a Goblin Gate
  candidate config: interfaces and VLANs, aliases, firewall rules, port forwards and outbound NAT, DHCP (ranges
  and static mappings), DNS resolver host and domain overrides, gateways, gateway groups and static routes,
  schedules, UPnP settings, time zone, NTP and DNS servers; pfBlockerNG and Suricata settings are mapped where
  there is an equivalent. If a pfSense interface does not match a port on this box, you pick it before the report.
  The report lists every item as converted, approximated or skipped, with the reason, and flags risky items
  (for example a port forward of every port). Nothing goes live until you review and commit.
  Passwords, certificates and private keys are never imported. CLI: goblin import-pfsense config.xml --devices wan=eth0,lan=eth1.
• Multi-WAN and policy routing. Gateways per WAN with health monitoring (ping loss and latency), gateway
  groups with tiers (failover) and weights (load sharing), a selectable default route, static routes, and a
  gateway per policy (route one VLAN through a second ISP or a VPN). Events wan_down / wan_up can be sent to
  your notification channels. Network → Gateways shows live status.
• VPN providers. WireGuard tunnels to providers such as Mullvad or Proton act as gateways, with an optional
  kill switch (traffic routed to the tunnel is dropped while it is down instead of leaking out the WAN).
• Schedules. Weekly time windows (Policy & Objects → Schedules) that a policy can be limited to, in the box's
  time zone, including overnight ranges; daylight-saving changes are handled.
• UPnP / NAT-PMP / PCP (Network → UPnP), off by default: pick the LAN interfaces, keep secure mode on, and
  optionally limit which clients may open which ports. Active mappings are listed live.
• Updates page (System → Updates): current and available version, release notes link, the channel, and an
  Update button with progress. A failed update still rolls itself back.
• IPv6 in the web UI: the IPv6 settings for interfaces and VLANs (DHCPv6 with prefix delegation, static,
  delegated, router advertisements) and IPv6 address objects.

Fixes

• Outbound NAT (masquerade) now applies only to traffic leaving a WAN interface, not to traffic between LANs.

Upgrading from 0.1.0-alpha.2

alpha.2 boxes follow the beta channel and see this version within 6 hours (or right away with
GET /api/v1/system/updates?refresh=1). Start the update with POST /api/v1/system/updates/apply, or on
the box as root: apt-get update && apt-get install goblin-gate. Reboot once afterwards if you plan to use
multi-WAN (a systemd-networkd setting it needs is read at boot).

From alpha.1, install the alpha.2 package first as described in the alpha.2 notes, then update as above.

Install

Download goblin-gate-0.1.0-alpha.3-amd64.iso below, boot it (BIOS or UEFI, Secure Boot works), pick the
disk, and open https://<LAN address> to run the setup wizard.