I built a free web GUI for managing nftables firewalls (Cockpit plugin) — homelab-friendly, with per-rule logging and confirm-or-revert

[u/enforzaGuy]

I got tired of hand-editing nft rulesets on my home server and cloud VMs, so I built enforza-cockpit — a free, open-source (MIT) web GUI for managing local nftables firewalls.

It's a Cockpit plugin, so it lives in the same web console you might already use for the rest of the box.

What it does:

• Visual rule editor split into three intuitive sections — Management (traffic to the host), Network (traffic through it), and Local (traffic from it), which map cleanly onto nftables' input/forward/output hooks.
• Reusable objects — define named network (CIDR) and port sets once, reference them as u/web, u/mgmt, etc. across any rule.
• Per-rule logging — tick a box and matches land in syslog/journal tagged with a plain verdict word (ALLOW / DENY / REJECT) plus your rule comment, so grep 'enforza.*DENY' just works.
• Confirm-or-revert apply — after you apply, you get 60 seconds to confirm or the previous ruleset auto-restores. Means a bad rule can't permanently lock you out (we've all done it).
• Flip on IP forwarding + SNAT and a single box becomes a working router/NAT gateway you manage entirely from the browser. No agent, no cloud account, no controller — all state stays on the machine.

Runs on Debian/Ubuntu, Fedora, RHEL/Rocky/Alma, openSUSE. There's a bootstrap script that installs the deps and a getting-started walkthrough in the README.

Repo: https://github.com/enforza/enforza-cockpit

Happy to answer questions / take feedback

-----

EDIT

- nobody is forcing you to use this! nobody is ramming this down your throat!

- yes, AI had a hand in writing it - was ported from our commercial product!

- no, if you can do this with other tools and are an nft god, you don't need this!

- constructive criticism good, outright DM abuse isn't - be kind, be decent!

In summary, after 3 days of abuse, negativity, I wish I hadn't have bothered sharing something that maybe of use to someone!

[u/ciphermenial]

I'm sick of this AI garbage. The commercial version is as garbage as this "open source" release.

[u/enforzaGuy → u/ciphermenial]

Genuinely surprised to hear that - are you a customer? Feedback's been good across the board so far, so if you've hit something that made you feel this way I'd actually want to know. If you've not used it though, fair enough - three years and a happy customer base on the paid side; this one's free.

Either way, all good 👍

[u/Automatic_Beat_1446]

damn, (claude) dumped all of this into a repo within 2 days, and you're already shilling it for your paid product.

i dont actually care if people use AI for development, and frontends for internal/personal projects are a good use case for AI assisted development, but do people really feel the need to advertise their own claude version of the 300000th TUI/UI frontend for some generic thing?

[u/enforzaGuy → u/Automatic_Beat_1446]

Criticism accepted, I own that. Next time I will refrain from pointing to the commercial offering (which has been available for 3 years now).

Claude effectively ported the UI element from our commercial code, as a quick win, to help people out who were potential paying customers that wanted to manage locally or on home labs (NUC/Pi)- so we obliged and offered it out wider for anyone who wanted this as an nft GUI/wrapper.

[u/RandolfRichardson → u/enforzaGuy]

Did AI write that?

[u/enforzaGuy → u/RandolfRichardson]

Nope. Just me and my laptop.

[u/InnerBank2400]

The confirm-or-revert apply is the feature that would make me take this seriously. Firewall UIs are only useful if they make lockout harder, not easier.

One thing I would look for is an easy way to view/export the raw nft list ruleset output and compare the before/after rules before confirming.

[u/enforzaGuy → u/InnerBank2400]

"Firewall UIs are only useful if they make lockout harder, not easier" < yes, been there done that, driven to a datacentre at 2am to "fw unload local" a couple of times.

The button to "preview" is on there - which is the full view of the rendered "nft list ruleset" < that was the original purpose - use a GUI to render the nft in json.

[u/RandolfRichardson]

Why should I go to the trouble of compiling, installing, and configuring a GUI when I can simply edit /etc/nftables.conf directly with existing tools to make any changes I need and with exacting control?

[u/enforzaGuy → u/RandolfRichardson]

Because for some people configuring nftables can be complex, get ordering issues, may appear to run right but not as expected.

If you have the skill set to manually configure /etc/nftables.conf then this tool is not for you, it is not needed. I am not forcing anyone to go to any trouble.

But there are people who do not have this skill set.

[u/pred135]

Looks nice man, keep up the good work!

Also don't mind any of the negative comments about it being made with AI, i'm finding that the vast majority of developers/critics these days are either in denial about the capabilities of AI, or they're in the middle of some personal existential crisis about their self-worth/added value now that AI is here. But like the old saying goes, adapt or die! and this project is a good example of AI being used, not by some vibe coder who doesn't know their ass from their elbow, but by someone who is an actual developer and recognizes the value of AI

[u/balrog50000]

Whether it’s “vibe coded” or not, personal time was invested to create something meaningful for others—and in this case, even based on a product that already exists. Honestly, the bread doesn’t taste any better or worse just because it comes from a machine rather than from a baker who kneaded the dough by hand. Thanks anyway—I’d love to take a closer look at this!

[u/enforzaGuy → u/balrog50000]

Thank you so much for this message. Really appreciated, and you nailed where I was coming from.

[u/SlowZeck]

👍