Add what you need.
Nothing you don't.
FreeSense 1.1 has 34 optional packages. Each is built from source and signed by the project, and installed from System → Package Manager. A package is installed turned off, so nothing changes until you choose it.
Threat Shield.
See the threat. Stop it at the edge.
DNS filtering, IP threat lists, country blocking and inbound protection for the whole network, with a live threat map you can put on a wall. New in FreeSense 1.1, and it replaces pfBlockerNG.
The full-screen kiosk board, in four styles. Screenshots use example data (documentation address ranges).
- DNS filtering with AdGuard Home: block lists at three levels, an allowlist with one-click Unblock, per-client profiles and a searchable query log.
- Anti-bypass: devices with their own DNS are redirected, and DNS-over-TLS and known DNS-over-HTTPS servers are blocked.
- IP threat lists such as Spamhaus DROP, FireHOL and abuse.ch, loaded into firewall tables, plus GeoIP country blocking.
- Inbound protection: reputation checks and flood limits for services you expose to the internet.
- Health checks that show what works and offer a one-click fix when something does not.
Get it
- Open System → Package Manager and install Threat Shield & DNS Protection. It is installed turned off.
- On Stable from FreeSense 1.1.4; package version 1.1.0. amd64 and arm64.
- Under Services → Threat Shield; the dashboard under Status → Threat Shield Status.
More built-in strength.
Security and management packages that use the same WebUI, firewall rules and audit trail.
Secure Web Gateway
An outbound web gateway on Squid 7 with explicit and transparent proxying, TLS inspection modes, web policy and user authentication.
SecuritySuricata IDS/IPS
Network intrusion detection and prevention with ruleset management and event browsing.
SecurityCrowdSec
Behavior-based threat detection, enforced through a firewall alias and rule that FreeSense manages.
Development 1.2FreeSense Fleet
Self-hosted central management for many firewalls, with a live dashboard and a wall-screen view. Not a cloud service. An optional package, experimental in 1.2.
All 34 packages.
Each one has a page in the documentation with its settings, services and where to find it in the WebUI.
Security
Threat Shield & DNS Protection
Network-wide DNS filtering with AdGuard Home, IP threat lists, country blocking, inbound reputation checks and a live threat map.
Secure Web Gateway
Outbound web security gateway based on Squid 7: explicit and transparent proxying, TLS inspection modes, web policy, user authentication and logging.
Web Gateway Local Antivirus
Optional companion to the Secure Web Gateway that adds local malware scanning with ClamAV. Off until you enable it.
Suricata IDS/IPS
Network intrusion detection and prevention engine with ruleset management and event browsing.
CrowdSec
Behavior-based threat detection whose decisions are enforced through a FreeSense-managed firewall alias and rule.
ACME Certificates
Automatically issues and renews certificates from ACME services such as Let's Encrypt.
VPN
WireGuard
Fast, modern site-to-site and remote-access VPN tunnels.
Tailscale
Joins the firewall to a Tailscale mesh network, which is built on WireGuard.
ZeroTier
ZeroTier network membership, with explicit consent for managed routes and DNS, plus interface and peer status.
OpenVPN Client Export
Exports ready-to-use client configurations and bundles for the built-in OpenVPN servers.
Routing
Services
HAProxy
TCP and HTTP(S) load balancer and reverse proxy with ACL-based backend selection.
BIND Authoritative DNS
BIND DNS server for authoritative zones, with DNSSEC and DNS64 support.
Avahi Service Discovery
mDNS/DNS-SD (Bonjour) service discovery across LAN segments.
mDNS Bridge
Shares Multicast DNS information between interfaces so service discovery works across segments.
LLDP Service
Announces and discovers neighbors with LLDP and related discovery protocols such as CDP.
TFTP Server
TFTP server for network boot and device configuration files.
Authentication
Monitoring
ntopng Traffic Analysis
Real-time traffic analysis with a web interface, flow inspection and traffic history.
Neighbor Watch
Monitors ARP and IPv6 Neighbor Discovery, and reports when IP-to-MAC mappings change.
Traffic Totals
Hourly, daily and monthly traffic totals per interface, using vnStat.
Flow Exporter
Exports traffic flows as NetFlow to an external collector.
Prometheus Node Exporter
Exposes system metrics for Prometheus to scrape.
Telegraf
Agent that collects system metrics and sends them to time-series databases.
SNMP Agent
Net-SNMP agent and trap daemon for SNMP-based monitoring.
syslog-ng
A separate syslog server that receives, stores and forwards logs alongside the built-in logging.
Zabbix 7.0 Agent
Zabbix agent that reports local metrics to a Zabbix server or proxy.
Zabbix 7.0 Proxy
Zabbix proxy that collects monitoring data on behalf of a Zabbix server.
System and diagnostics
Automation
Scheduled commands and service-health watchdog, managed from one audited interface.
Network UPS Tools
Monitors local USB or serial UPS units, and remote ones over SNMP, apcupsd or NUT, and shuts down cleanly.
Open VM Tools
VMware guest integration for FreeSense running as a VMware virtual machine.
Network Diagnostics
Allow-listed MTR, Nmap, iperf3 and ARP tools with strict input validation.
Suricata and the Web Gateway antivirus are not built for arm64. Fleet and the QEMU Guest Agent are in the Development line only.
Every package is built in public.
The sources, build recipes and signing are public on GitHub under Apache-2.0, like the rest of FreeSense.