Donate to CanuteTheGreat/patronus

• github.com/sponsors/CanuteTheGreat

---

See the documentation for more details on donation links.

7 releases 8 tags

RSS feed

• v0.2.0 55bf050002

  Compare

  Patronus v0.2.0: device segmentation (opt-in) Stable

  Ghost released this 2026-10-30 07:32:21 -07:00 | 95 commits to main since this release

  Patronus 0.2.0: device segmentation

  Everything below is opt-in. A router upgraded from the previous release keeps behaving exactly as it did: isolation is off until you switch a segment on, DNS rebinding protection stays off on an existing store (it is on for new installs), and there are no policies, Wi-Fi networks or time limits until you create them. The five new migrations (1300, 1310, 1320, 1330/1331, 1340) are applied on first boot; upgrade-store.sh proves an upgrade from the previous release's store and from the v0.1.0 layout.

  What is new

  • Device segmentation and isolation (opt-in per segment). Devices have an identity (MAC bound to an address), belong to groups (home, quarantine, your own) and are default-deny between each other. Links between groups and one-way service rules (e.g. NAS -> camera on tcp 554) open exactly what you list. Unknown devices land in quarantine (DHCP, DNS and ping only, never the admin UI). Own nft table inet patronus_seg, same atomic apply as the main ruleset; revoking a device cuts its live connections. Page: Segmentation, API: /api/segmentation.
  • Per-device Wi-Fi credentials (USE=wifi-ap). One passphrase per device on one SSID (hostapd per-MAC PSK). WPA2: live, add / rotate / revoke without restarting the access point. WPA3 (SAE): needs an AP restart whenever a password changes, because stock hostapd reads SAE passwords only at start; the UI says so and every station reconnects for a few seconds. A device created without a MAC is enrolled by its first join. Show-passphrase / QR for phones.
  • DNS rebinding protection. Unbound private-address / dnsmasq stop-dns-rebind, with per-domain exceptions for your split-horizon names. On for new installs, off for upgraded stores.
  • Per-device and per-group DNS policy and query logs. Block lists, allow/block/override rules, family preset (adult + malware lists, safe search), DNS-over-TLS refused for devices under a policy, optional per-policy query log with search and CSV export (needs DNS resolver mode / Unbound).
  • Parental time limits. Allowed windows plus a daily quota of active minutes per device or group, a warning before the cut, a "time's up" page on plain HTTP, DNS and DHCP kept alive while blocked, +N minutes / pause / resume for parents. Own nft table inet patronus_time; the block survives a reboot.
  • Traffic insight history with country and ASN (USE=insight). Hourly per-device totals by country and ASN from DB-IP Lite databases (patronus ipdb update, monthly timer), retention and a "do not record" list for privacy. Insights page: Live, Countries, ASNs, Devices, Uplinks, Settings.
  • Uplink health and SLA alerts. Per-gateway round-trip time, loss and availability history, extra DNS / TCP / HTTP probes sent through each gateway's own interface (an ISP that pings but has dead DNS shows as degraded), outage list, SLA target with alerts in the event log and webhooks.

  Documented limits (please read)

  • Unmanaged switches: wired devices behind an unmanaged switch share one switch port, so the switch forwards between them without the router; they cannot be isolated from each other (put them in one group, or use a managed switch with port isolation).
  • IPv6 binding is next: IPv6 between devices of an isolated segment is denied and an unknown MAC forwards no IPv6, but per-address IPv6 identity binding (SLAAC / privacy addresses) is not done yet.
  • Simulated radios only: the Wi-Fi code is proven on mac80211_hwsim with stock hostapd 2.10 (26/26 checks, nightly CI job). It has not been run on real Wi-Fi hardware yet. DNS-over-HTTPS cannot be blocked reliably.

  Proof

  CI on the release commit: Format + Clippy (whole workspace, -D warnings) + Test, privileged netfilter tests, netlab (journeys, failure/recovery, upgrade), netlab-features (every lane-s-* scenario: segmentation 67 checks, DNS rebinding, time limits, insight, uplink), Gentoo OpenRC and systemd builds, feature matrix. Nightly: Wi-Fi on mac80211_hwsim, previous-release upgrade with 30 power cuts, mutation floors (new floor for seg_rules.rs: 63 of 63 mutants caught).

  Artifacts

  • patronus-v0.2.0-x86_64-unknown-linux-gnu.tar.gz (patronus-web, patronus-cli, docs) sha256 93aa2f7a6997e097f5f27bb50031477559775063dc4b09d57944f2e3ff69577f
  • patronus-v0.2.0-aarch64-unknown-linux-gnu.tar.gz (built with thin LTO) sha256 a0581219c0de4efe206a1a4527af7a4945ca7e68a60a4c2b71f74f725578d3b7
  • Both are glibc builds made on Ubuntu 24.04 (need glibc >= 2.39); no musl or riscv64 archives. The supported ways to run Patronus are the live/installer ISO and the Gentoo ebuild net-firewall/patronus-0.2.0.
  • Live/installer ISOs, both built from the tagged commit and tested in QEMU (boot, install, reboot, web UI; UEFI/BIOS, serial/VGA/graphical installer, rescue/forensic/live modes):
    • patronus-v0.2.0-x86_64.iso sha256 a0f4a44875f43d19a0ee889520c46c49d25f204b3b71cec8ae92257627afdd87 (the tested daily ISO of commit 55bf0500, CI run 7701; the tag run's own x86_64 job hit the runner's 3 h limit)
    • patronus-v0.2.0-aarch64.iso sha256 a13cb776fe52cfe542e62a11ac0ca298f218fa657dbcdf1324ce8faf9fc23a2e (tag run 7716, QEMU TCG)
    • test evidence: *-iso-test-evidence.tgz; the rolling daily pre-release carries the same tree
  • Every archive was started once in CI (patronus-cli --version) from the files inside the archive before it was attached.

  Downloads

  • patronus-v0.2.0-aarch64.iso
    9 downloads · 2026-10-30 18:10:28 -07:00 · 1.5 GiB
  • patronus-v0.2.0-aarch64.iso.sha256
    2 downloads · 2026-10-30 18:10:29 -07:00 · 94 B
  • patronus-v0.2.0-aarch64-iso-test-evidence.tgz
    2 downloads · 2026-10-30 18:10:29 -07:00 · 597 KiB
  • patronus-v0.2.0-aarch64-unknown-linux-gnu.tar.gz
    3 downloads · 2026-10-30 08:04:26 -07:00 · 21 MiB
  • patronus-v0.2.0-aarch64-unknown-linux-gnu.tar.gz.sha256
    3 downloads · 2026-10-30 08:04:27 -07:00 · 115 B
  • patronus-v0.2.0-x86_64.iso
    2 downloads · 2026-10-30 17:35:17 -07:00 · 1.5 GiB
  • patronus-v0.2.0-x86_64.iso.sha256
    2 downloads · 2026-10-30 17:35:18 -07:00 · 93 B
  • patronus-v0.2.0-x86_64-iso-test-evidence.tgz
    1 download · 2026-10-30 17:35:19 -07:00 · 5.6 MiB
  • patronus-v0.2.0-x86_64-unknown-linux-gnu.tar.gz
    3 downloads · 2026-10-30 08:02:40 -07:00 · 23 MiB
  • patronus-v0.2.0-x86_64-unknown-linux-gnu.tar.gz.sha256
    3 downloads · 2026-10-30 08:02:40 -07:00 · 114 B

  ---

  • Source code (ZIP)
    1 download
  • Source code (TAR.GZ)
    1 download