Puffer Router: Enterprise Firewall for Your Home
Puffer Router turns what you want your network to do into firewall policy that actually enforces it. Declare your intent — “block malware and trackers,” “keep the kids off adult sites,” “force the smart TV through a VPN,” “give guests their own access” — and Puffer compiles it into a hardened OpenBSD firewall configuration.
What Puffer Does
Network Protection
| Goal | What Puffer does |
|---|---|
| Stay safe | Default-deny firewall with Unbound DNS blocklists for malware, phishing, and scam sites |
| Protect the family | Category content filtering and per-device allow/block rules |
| Protect your privacy | Tracker/ad blocking and per-client force-VPN egress over WireGuard |
| Cover every device | Whole-network protection with automatic device identity via DHCP + ARP |
| Work from home | WireGuard road-warrior hub and policy-based VPN routing |
| See everything | Live dashboards showing network activity and firewall counters |
Security Posture
Management Plane Security
- TLS/SSL: HTTPS-only management (self-signed bootstrap or ACME certificates)
- Authentication: SPAKE2+ password-authenticated key exchange — password never leaves the client
- Session Management: JWT tokens with role-based access control
- CSRF Protection: SameSite strict cookies + CSRF tokens on all mutations
- Rate Limiting: Login attempt rate limiting and PF management rate limits
- Audit Trail: All operations logged with actor identity, timestamp, and IP
Network Security
- Default-Deny Firewall: All traffic blocked unless explicitly allowed
- LAN-Only Management: PF rules restrict management ports to LAN only
- Atomic Deploys: Validated configs only — bad configs never go live
- Rollback Support: Every apply saves a timestamped snapshot
IDS/IPS & Security Features
| Feature | What Puffer does |
|---|---|
| Intrusion Detection | Suricata IDS with ET Open ruleset for threat detection |
| Certificate Management | Self-signed TLS with optional ACME certificates |
| Dynamic DNS | Built-in DDNS watcher with provider integration |
| Audit Logging | Authenticated actions logged with full context |
Why Not Edit pf.conf Directly?
Puffer uses construct-based configuration. You declare what you want, and Puffer:
- Validates your intent against supported constructs
- Generates the appropriate pf.conf rules
- Validates the configuration with OpenBSD tools
- Applies atomically (temp-file + rename pattern)
- Saves rollback snapshots
No syntax errors, no guesswork, no accidentally shipping an invalid config.
Use Cases
- Family filtering: Block adult content, social media during homework time
- Privacy routing: Force specific devices through VPN or Tor
- Guest networks: Isolate guest devices from your main LAN
- IoT segregation: Keep smart devices on their own restricted network
- Remote work: Secure road-warrior access with WireGuard
Tech Stack
- OS: OpenBSD (current stable)
- Firewall: PF with rule generation
- DNS: Unbound with blocklist integration
- IDS: Suricata with ET Open/ET PRO rulesets
- Language: Rust for control plane, Python for configuration
Conclusion
Puffer Router brings enterprise-grade network protection to home networks without requiring command-line expertise. Declare what you want, and Puffer makes it happen safely.
Full documentation, architecture diagrams, and source code available in the project repository.