Panoptes

Linux Secure Network

Private DNS, a Cloudflare WARP kill-switch with a Proton VPN fallback, and network intrusion detection for Linux. The all-seeing network watch.

A Linux network security suite: encrypted, filtered DNS (AdGuard over DoT with DNSSEC, Quad9 and Cloudflare behind it), Encrypted Client Hello in every browser that can do it, a Cloudflare WARP tunnel with a verified kill-switch and self-healing watchdog, Proton VPN as the fallback tunnel with WARP parked safely underneath it, a two-icon system-tray control for the resolver and the tunnels, monitors that watch firewall drops (firewalld or ufw) and the ARP table for port scans and spoofed gateways, an outbound application firewall (OpenSnitch) and a persistence watch (osquery) that lists what runs at boot or login and tells you when that changes — plus deep investigation of any address that touches the machine. This is a a comprehensive Endpoint Detection and Response (EDR) hardening framework for Linux. Twenty-three command-line tools. One installer sets it all up, including its dependencies, the Proton VPN client and the endpoint pair, on Fedora, Debian, Ubuntu, Mint, Arch and openSUSE, on x86_64 and aarch64.

Built and used daily on Fedora , a portable Linux Mint (MATE) stick, Manjaro, EndeavourOS, Debian/Ubuntu and Fedora Asahi Remix (Apple Silicon). Nothing in it is tied to one machine: the distribution, package manager, Wi-Fi interface, desktop toolkit and tunnel clients are all read at run time. Anything running systemd-resolved and NetworkManager is in scope; the list above is where it has been run, not a limit.

Why Panoptes

Argus Panoptes, "the all-seeing", was the giant of Greek myth with a hundred eyes. Hera set him to guard Io, whom Zeus had hidden as a heifer, because he never slept: while some of his eyes rested, the rest kept watch, so nothing crossed the ground he guarded unseen. It took Hermes a whole night of stories and flute-playing to close every eye at once before he could kill him, and Hera set the hundred eyes in her peacock's tail so they would never be lost. That is the job this suite does for a Linux system: eyes on the resolver, the tunnel, the ARP table and the firewall log at the same time, and no moment when all of them are closed. The macOS sibling, Panoptes-macOS, is the same watchman rebuilt on networksetup, scutil, pf and launchd.

Why this exists

Most network trouble on a modern Linux desktop is not a routing problem. It is a DNS problem wearing a routing problem's clothes: your VPN pushed its own resolver, DHCP quietly overrode the one you configured, systemd-resolved is answering from a per-link server you never chose, or a kill-switch left an nftables table behind after the daemon died.

These tools were written one outage at a time, each after a real failure that took hours to diagnose by hand. netmaster exists because a Wi-Fi link associated fine, LAN worked, and the internet was simply gone — and stayed gone across reboots. probesource exists because "who is 5.42.x.x and why is it knocking" deserved a better answer than four terminals of whois, dig and tcpdump. warp-killswitch exists because a WARP daemon that dies, or wedges, leaves a firewall with policy DROP behind it and the machine goes dark while every indicator says "connected". proton-fallback exists because raising a second tunnel over a merely-disconnected WARP is how that wedge happens.

What Encrypted Client Hello is, and why it matters

HTTPS encrypts what you send and receive. It does not encrypt which site you are talking to. The very first packet of a TLS handshake — the ClientHello — carries the hostname in a field called SNI, in the clear, before any encryption exists. Anyone on the path reads it: your ISP, the coffee-shop router, the hotel network, a national firewall, a corporate middlebox.

That single field is how most real-world web filtering and logging works. Not by breaking encryption — by reading the label on the envelope.

People usually plug the DNS half of this leak first, with DNS-over-HTTPS or DNS-over-TLS, and reasonably conclude they are covered. They are not. Encrypting your lookups hides the question; SNI still announces the answer a few milliseconds later, on every single connection.

ECH closes that hole. The site publishes a public key in a DNS HTTPS record. Your browser encrypts the real ClientHello — hostname included — to that key, and wraps it in an outer one naming only the provider. An observer sees a connection to cloudflare-ech.com, or whatever the front is, and cannot tell which of the millions of sites behind it you asked for.

This is the beginning of the README. Read the rest at the original. Read the full README ↗