English | 中文

PulseGate

Transparent, Wire-Speed Network Traffic Filter & Smart Gateway Protection for OpenWrt and Linux Routers.

PulseGate is a lightweight, high-performance transparent network traffic filter and gateway security program engineered for modern routers and Linux gateway servers. By deploying PulseGate at your router or gateway, every device in your local area network (LAN)—smartphones, computers, smart TVs, and IoT hardware—is instantly protected without installing any client apps, certificates, or plugins.

---

🖥️ Web Console Preview

PulseGate includes a built-in, responsive real-time management dashboard accessible directly from your browser:

---

✨ Key Advantages & Features

1. 🛡️ Zero-Touch Client Transparent Protection

• No Client Installation: Protect all connected clients (phones, laptops, smart TVs, IoT sensors) without touching individual endpoints.
• Zero Configuration: No SSL/TLS root certificates or complex proxy profiles required on devices.

2. 🔐 Modern Protocol Deep Inspection (TLS & QUIC)

• Comprehensive Encryption Support: Native deep handshake inspection for both TCP TLS and modern UDP QUIC (HTTP/3) traffic.
• ECH Awareness: Detects and handles Encrypted Client Hello (ECH) traffic to ensure accurate policy enforcement.

3. 🚫 Encrypted DNS Enforcement & Anti-Bypass

• Prevent DNS Bypass: Restricts LAN devices from bypassing local DNS to access unauthorized external DoH/DoT resolvers.
• Remote DNS Blocklists: Subscribe to remote encrypted DNS threat domain and IP blocklists to prevent DNS leaks and ensure unified security.

4. 🗺️ GeoIP & SOCKS5 Policy Outbound Routing

• Country & IP Routing: Intelligent outbound traffic splitting based on GeoIP country databases and CIDR subnets.
• Multi-Proxy Support: Configure multiple SOCKS5 proxy outbounds with independent TCP and UDP routing rules.
• Graceful Failover: Automatic fallback to direct pass-through or safe block policy on proxy failure.

5. ⚡ Wire-Speed Forwarding & Ultra-Low Latency

• Native Fast-Path Throughput: Once a connection stream is verified, packets flow directly at native hardware wire speed.
• Negligible CPU Overhead: Highly optimized design ensures gaming ping remains unaffected and 4K/8K video streaming stays completely smooth.

6. 🌐 High-Precision Multi-Source Rule Engine

• Multi-Source Remote Sync: Automatically synchronizes and merges multiple remote HTTPS threat blocklists and hosts feeds (e.g. StevenBlack, HaGeZi, anti-AD).
• Intelligent Deduplication: Deduplicates domains and resolves overlaps in background updates.
• Multi-Dimensional Matching: Supports exact domains, wildcard domain suffixes, and IP CIDR ranges.
• Offline Fallback Database: Built-in offline security database ensures immediate protection on first boot without internet access.

7. 🔒 Fail-Open Reliability & Zero Outages

• Zero Network Dropouts: Designed for mission-critical home and enterprise networks.
• Safe Fallback: In the event of unclassified traffic, service reloads, or background updates, traffic safely falls back to pass-through mode so your internet connection is never interrupted.

8. 📊 Built-in Real-Time Web Console

• Self-Contained Dashboard: Integrated web server with zero external dependencies (no Nginx/Apache/PHP/Node.js needed).
• Live SSE Audit Stream: Real-time event stream of connection verdicts (Allowed / Blocked), protocol types (TCP/UDP/TLS/QUIC), client LAN IPs, destination domains, and classification reasons.
• Online Management: Manage threat subscriptions, DNS enforcement, GeoIP routing rules, and custom allow/block lists with instant effect.
• System Health Diagnostics: Real-time metrics including uptime, fast-path rates, throughput, active flows, and memory usage.

9. 🪶 Single Lightweight Binary, Zero Dependencies

• Standalone Static Executable: Available for both x86_64 and ARM64 architectures.
• Ultra-Low Memory Footprint: Uses minimal memory and CPU resources, making it ideal for embedded OpenWrt routers.

---

🎯 Supported Platforms & Architectures

Platform / Architecture	Compatibility	Description
OpenWrt	✅ Supported	Compatible with x86_64 soft routers, embedded routers, and custom OpenWrt builds.
Linux Gateways & Servers	✅ Supported	Compatible with Debian, Ubuntu, Alpine, CentOS, Rocky Linux, Arch Linux, etc.
x86_64 (amd64)	✅ Supported	Native standalone static binary.
ARM64 (aarch64)	✅ Supported	Native standalone static binary for ARM routers and SBCs.

---

🚀 Quick Start Guide

Step 1: Download PulseGate

Download the prebuilt binary corresponding to your router's CPU architecture from GitHub Releases:

• pulsegate-x86_64-unknown-linux-musl for x86_64 soft routers and PCs.
• pulsegate-aarch64-unknown-linux-musl for ARM64 routers and devices.

Step 2: Upload to Router and Grant Permissions

Upload the binary to your router (e.g. /usr/bin/pulsegate) and grant executable permissions:

chmod +x /usr/bin/pulsegate

Step 3: Prepare Configuration (pulsegate.toml)

Create a configuration file at /etc/pulsegate.toml or alongside the binary:

# Network interfaces on the LAN side to protect
lan_interfaces = ["br-lan"]
workers = 4

# Web Management Console
[web]
enabled = true
listen = "0.0.0.0:8088"
allowed_hosts = ["openwrt.lan"]
username = "admin"
password = "pulsegate"

# Encrypted DNS Enforcement (Anti-Bypass & Leak Prevention)
[dns_enforcement]
enabled = true
redirect_port = 53
domains = []
domain_suffixes = []
ips = []

[[dns_enforcement.domain_sources]]
id = "hagezi-doh"
name = "HaGeZi Encrypted DNS Domains"
enabled = true
url = "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/wildcard/doh-onlydomains.txt"
refresh_hours = 24
min_entries = 1000

# Policy Outbound Routing (GeoIP & SOCKS5 Proxies)
[routing]
enabled = false
geoip_path = "GeoLite2-Country.mmdb"
outbounds = []

[routing.tcp]
default_outbound = "direct"
rules = []

[routing.udp]
default_outbound = "direct"
rules = []

# Custom Allow Rules (Whitelist)
[allow]
domains = ["my-safe-domain.com"]
domain_suffixes = ["internal.lan", "local"]
ips = []

# Custom Block Rules (Blacklist)
[block]
domains = ["ads.example.com"]
domain_suffixes = ["tracker.example.com"]
ips = []

# Remote Threat / Ad-blocking Subscriptions
[[sources.hosts]]
id = "stevenblack"
name = "StevenBlack Unified Hosts"
enabled = true
url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts"
refresh_hours = 24
min_domains = 50000

Step 4: Verify & Start PulseGate

Check configuration and system capabilities:

pulsegate --config /etc/pulsegate.toml check

Start PulseGate:

pulsegate --config /etc/pulsegate.toml run

Step 5: Open Web Console

Open your browser and navigate to:

http://<your-router-ip>:8088

• Default Username: admin
• Default Password: pulsegate

(Please change the password in pulsegate.toml for production deployments).

---

🛠️ Command Line Reference

Usage: pulsegate [OPTIONS] [COMMAND]

Commands:
  run       Run the transparent forwarding filter (default)
  check     Validate configuration syntax and system capabilities
  cleanup   Remove leftover rules after an unexpected reboot/shutdown
  rules     Manage and update downloaded rule subscriptions
  help      Print this message or the help of the given subcommand(s)

Options:
      --config <PATH>  Path to the pulsegate.toml configuration file
  -h, --help           Print help

Useful CLI Examples:

• Run in background (service):

  pulsegate --config /etc/pulsegate.toml run

• Manually trigger rule updates:

  pulsegate --config /etc/pulsegate.toml rules update

• Clean up lingering state:

  pulsegate cleanup

---

📑 Web Console Features

1. Runtime Telemetry: Monitor processed flows, active security rules, wire-speed throughput rates, and system resources in real time.
2. Live Decision Stream: Inspect live connection verdicts (Allowed / Blocked), protocol types (TCP/UDP/TLS/QUIC), client LAN IPs, destination domains, and matching reasons.
3. Encrypted DNS & Threat Rules: View subscription health, synchronization status, and trigger on-demand syncs.
4. Policy Outbound Routing: Manage GeoIP country routing rules, SOCKS5 proxy outbounds, and failover behavior.
5. Online Rule Editor: Instantly append domains, wildcard suffixes, or IP subnets to allowlists and blocklists with hot-reload.