InterFire

Linux-first Rust application firewall.

Linux-first application firewall in Rust: attribute outbound connections to processes, match durable rules, and accept or drop via NFQUEUE when the operator installs the InterFire-owned queue rule and the daemon has caps.

Canonical repo: Interchouette-ITC/InterFire.

Status today: The daemon and CLI speak a versioned Unix-socket protocol, persist TOML rules, resolve process identity via /proc, attach a TCP-connect eBPF observer when capabilities allow, consume ring-buffer events, and can bind NFQUEUE 4242 for allow/deny (prompt and unattributed → deny until answered over IPC). Live filtering needs the InterFire-owned nftables table (inet interfire, queue 4242) via Network tab or interfirectl network install, plus root/caps; use --no-ebpf and/or --no-nfqueue for non-root smoke. Interactive ops use interfire-tui. GPUI desktop shell (interfire-ui) includes tray, connection alert, Rules, Applications, Network, Log, Profiling, and RSS gates. Build an installable .deb with make deb (see packaging.md and install-matrix.md). Primary targets: Debian (stable) with GNOME, and Pop!_OS. Production latency/coexistence measurements remain open.

What you get today

Piece	Role
interfire-rules	Deterministic application-rule matching + TOML store
interfire-proto	Versioned, bounded Unix-socket framing
interfired	Daemon: IPC, rules, ringbuf → /proc → rules → NFQUEUE
interfirectl	One-shot CLI: ping, status, rules / prompts / dns / audit / network
interfire-tui	ratatui control-plane TUI (interactive status / apps / rules / prompts / log)
interfire-ebpf*	TCP-connect observation program + aya loader
interfire-ui	GPUI desktop shell: tray, alert, Rules, Applications, Network, Log, Profiling
Docs	Architecture, threat model, UX contract and studies

Packaging: make deb and packaging.md. Verify install gates on Debian GNOME and Pop!_OS with install-matrix.md.

Quick start

git clone https://github.com/Interchouette-ITC/InterFire.git
cd InterFire
make ci

Non-root smoke (daemon + CLI on a temp socket):

cargo run -p interfire-daemon -- --socket=/tmp/interfire.sock --no-ebpf --no-nfqueue
cargo run -p interfirectl -- --socket=/tmp/interfire.sock ping
cargo run -p interfirectl -- --socket=/tmp/interfire.sock status

Isolated NFQUEUE accept/drop test (root, temporary network namespace only):

sudo scripts/nfqueue-spike.sh

Daemon allow/deny integration (root; builds debug binaries first via Make):

sudo make integration

Idle daemon RSS budget (< 40 MiB, non-root):

make memcheck

UI RSS release gates (DISPLAY or xvfb-run; not in make ci):

make memcheck-ui

See architecture.md for the verdict path and how the isolated NFQUEUE test is scoped.

Docs

Doc	Topic
architecture.md	Event flow, NFQUEUE verdict path, baseline
packaging.md	systemd units, paths, reboot recovery
install-matrix.md	Install/upgrade/reboot/uninstall gates
threat-model.md	Assets, trust boundaries, controls
ux-interfire.md	Locked UI contract
ux-kerio.md	Kerio-era interaction study
CONTRIBUTING.md	Lint bar, Make targets, PR habits
pull_request_template.md	PR Summary + Test plan template
CODE_OF_CONDUCT.md	Community standards
SECURITY.md	Vulnerability reporting
brand/	Brand assets
../docs-dev/README.md	Developer docs index
api-rust/	rustdoc after make doc

Layout

crates/interfire-rules/          rule matching + TOML persistence
crates/interfire-proto/          IPC version + frame bounds
crates/interfire-daemon/         interfired
crates/interfirectl/             one-shot CLI
crates/interfire-tui/            ratatui control-plane TUI
ui/                              interfire-ui (GPUI desktop)
crates/interfire-ebpf/           TCP event contract + aya loader
crates/interfire-ebpf-programs/  TCP-connect eBPF program (bpfel)
docs/                            product docs (this hub)
docs/brand/                      public brand masters + size variants
docs-dev/                        developer notes
fixtures/                        rule fixtures
scripts/                         capability probe + NFQUEUE test helpers
packaging/systemd/               interfired + interfire-nft units
packaging/nft/                   owned inet interfire script
packaging/tmpfiles.d/            run/state/config dirs
packaging/defaults/              default rules.toml
packaging/debian/                desktop entry + deb staging helpers

Contributing

1. Read CONTRIBUTING.md and ../docs-dev/DEVELOPMENT.md.
2. Prefer Make targets (make ci) over ad-hoc cargo lines.
3. One concern per PR. Commits and docs in English.
4. Keep enforcement claims honest: the verdict path is wired; operator nft, caps, and production measurements still matter.

Thanks

InterFire stands on excellent open-source projects and Linux kernel surfaces:

Project	Role here
Rust	Daemon, CLI, TUI, desktop shell, and crates
Tokio	Async runtime where the control plane needs it
aya	eBPF loader and TCP-connect observation path
nftables / Netfilter	InterFire-owned table (operator-installed) + NFQUEUE verdict path
ratatui	interfire-tui control plane
GPUI / gpui-kit	interfire-ui desktop shell
nix	Unix IPC peer credentials and related syscalls
tracing	Structured daemon diagnostics

Thank you to their maintainers and communities.

License

Apache-2.0 (Apache License, Version 2.0). See ../LICENSE.