A web-based network management platform for Linux that provides centralized management of firewall, routing, VPN, QoS, monitoring, and custom eBPF modules.
Download the latest preview ISO:
https://github.com/styx-firewall/styx-flf
Warning: This is tech preview intended for testing only.
The capabilities are currently marked as dev/test
"dev" is still under development and may have limited functionality or known issues, while "test" features are more advanced and should work but require further testing.
Configure physical and virtual interfaces
- Physical Interfaces test
- VLAN dev
- Bridge test
- MacVLAN test
- Bond dev
- Loopback test
- PPPoE dev
- VTI dev
- GRE dev
- VXLAN dev
- VRF dev
- XFRM dev
- Full nftables rule management across filter and NAT tables.
- Object-based configuration model.
- Static routes.
- Multipath routing.
- Routing tables.
Support for:
- BGP (test)
- OSPF (dev)
- RIP (dev)
- BFD (test)
- IGMP proxy support (dev)
- IKEv1 and IKEv2.
- Tunnel and transport modes.
- Site-to-site and remote access (road warrior).
- Complete tunnel lifecycle management from the web interface.
Packet marking support for:
- Routing
- Firewall
- Traffic Control (TC)
- Support for the most commonly used qdiscs.
- Rate-limited classes.
- Traffic classification filters.
- Rules
- Real-time monitoring charts and status.
- Real-time interface traffic statistics.
- CORE support (tes)t
- BCC dev
- Attach, detach, and manage kernel eBPF programs.
- Per-module statistics.
- Telemetry/Events and alerts integrated into the dashboard (Telemetry).
- ICMP (test)
- iperf3 bandwidth testing.
- Internal service watchdogs.
- Role-Based Access Control (RBAC).
- Fine-grained permissions.
- Multi-user support.
- AppArmor configuration and policy management.
- Internal auditing.
- auditd configuration and log management.
- Host event detection.
- Network topology Discovery.
- Anomalies/services detection in networks (planned)
- Suricata IDS/IPS support.
- REST API with token-based authentication.
- Complete configuration management through the API.
- Firewall, VPN, interfaces, routing, and QoS management.
- Every feature available in the web interface is also available through the API.
- NOTE: The current API is not the final version, it was developed as an initial interface to enable real-world internal testing of the software. A significant API redesign is planned for the future.
The telemetry system is a generic, subsystem-agnostic pub/sub pipeline that collects, routes, stores, and exports operational data between components and external services. While the initial producer is the eBPF subsystem, the pipeline is designed to support other services and modules in the future.
StyX is built as a Linux-native management layer around existing kernel networking and security subsystems.
The platform does not implement networking functionality itself where the Linux kernel already provides it. Instead, it provides a unified configuration and management layer for subsystems such as:
- Linux networking and routing
- nftables
- IPsec / XFRM
- Traffic Control (TC)
- eBPF
- Linux services and system components
The management layer maintains a unified configuration model and translates it into the corresponding Linux subsystem configuration. Operational state, events, statistics, and logs are collected back into the platform for monitoring and automation.
The architecture is designed to keep subsystem-specific functionality isolated while exposing a consistent management interface through the web UI and API.
- Configuration backup and restore.
- Unified configuration model with distinct running and startup states.
- System/Networking logging and Telemetry bus (pub/sub)
- Session-based and token-based authentication.