English | 中文

PulseGate

Transparent, Wire-Speed Network Traffic Filter & Gateway Protection for OpenWrt and Linux Routers.

PulseGate is a lightweight, high-performance transparent network traffic filter built for modern routers and gateway servers. By deploying PulseGate at the network gateway, every device in your local area network (LAN)—smartphones, computers, smart TVs, and IoT hardware—is instantly protected without installing any client apps, certificates, or plugins.

---

🖥️ Web Console Preview

PulseGate includes a built-in, responsive real-time management dashboard accessible directly from your browser:

---

✨ Key Advantages & Features

1. 🛡️ Zero-Touch Client Transparent Protection

• No Client Installation: Protect all connected clients (phones, laptops, smart TVs, IoT sensors) without touching individual endpoints.
• Zero Configuration: No SSL/TLS root certificates or complex proxy profiles required on devices.

2. ⚡ Wire-Speed Forwarding & Ultra-Low Latency

• Native Fast-Path Throughput: Once a connection stream is verified, packets flow directly at native hardware wire speed.
• Negligible CPU Overhead: Highly optimized design ensures gaming ping remains unaffected and 4K/8K video streaming stays completely smooth.

3. 🌐 High-Precision Multi-Source Rule Engine

• Multi-Source Remote Sync: Automatically synchronizes and merges multiple remote HTTPS hosts and threat blocklists.
• Intelligent Deduplication: Deduplicates domains and resolves overlaps in background updates.
• Multi-Dimensional Matching: Supports exact domains, wildcard domain suffixes, and IP CIDR ranges.
• Offline Fallback Database: Built-in offline security database ensures immediate protection on first boot without internet access.

4. 🔒 Fail-Open Reliability & Zero Outages

• Zero Network Dropouts: Designed for mission-critical home and enterprise networks.
• Safe Fallback: In the event of unclassified traffic, service reloads, or background updates, traffic safely falls back to pass-through mode so your internet connection is never interrupted.

5. 📊 Built-in Real-Time Web Console

• Self-Contained Dashboard: Integrated web server with zero external dependencies (no Nginx/Apache/PHP/Node.js needed).
• Live Stream Audit: Real-time event stream of connection decisions, client IPs, destination domains, and classification reasons.
• Source & Rule Management: Manage threat subscriptions and custom allow/block rules online.
• System Health Diagnostics: Real-time metrics including uptime, fast-path rates, throughput, and memory usage.

6. 🪶 Single Lightweight Binary, Zero Dependencies

• Standalone Static Executable: Available for both x86_64 and ARM64 architectures.
• Ultra-Low Memory Footprint: Uses minimal memory and CPU resources, making it ideal for embedded OpenWrt routers.

---

🎯 Supported Platforms & Architectures

Platform / Architecture	Compatibility	Description
OpenWrt	✅ Supported	Compatible with x86_64 soft routers, embedded routers, and custom OpenWrt builds.
Linux Gateways & Servers	✅ Supported	Compatible with Debian, Ubuntu, Alpine, CentOS, Rocky, Arch Linux, etc.
x86_64 (amd64)	✅ Supported	Native standalone static binary.
ARM64 (aarch64)	✅ Supported	Native standalone static binary for ARM routers and SBCs.

---

🚀 Quick Start Guide

Step 1: Download PulseGate

Download the prebuilt binary corresponding to your router's CPU architecture from GitHub Releases:

• pulsegate-x86_64-unknown-linux-musl for x86_64 soft routers and PCs.
• pulsegate-aarch64-unknown-linux-musl for ARM64 routers and devices.

Step 2: Upload to Router and Grant Permissions

Upload the binary to your router (e.g. /usr/bin/pulsegate) and grant executable permissions:

chmod +x /usr/bin/pulsegate

Step 3: Prepare Configuration (pulsegate.toml)

Create a configuration file at /etc/pulsegate.toml or alongside the binary:

# Network interfaces on the LAN side to protect
lan_interfaces = ["br-lan"]

# Web Management Console
[web]
enabled = true
listen = "0.0.0.0:8088"
allowed_hosts = ["*"]
username = "admin"
password = "pulsegate"

# Custom Allow Rules (Whitelist)
[allow]
domains = ["my-safe-domain.com"]
domain_suffixes = ["internal.lan", "local"]

# Custom Block Rules (Blacklist)
[block]
domains = ["ads.example.com"]
domain_suffixes = ["tracker.example.com"]

# Remote Threat / Ad-blocking Subscriptions
[[sources.hosts]]
id = "stevenblack"
name = "StevenBlack Unified Hosts"
enabled = true
url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts"
refresh_hours = 24
min_domains = 50000

Step 4: Verify & Start PulseGate

Check configuration and kernel capabilities:

pulsegate --config /etc/pulsegate.toml check

Start PulseGate:

pulsegate --config /etc/pulsegate.toml run

Step 5: Open Web Console

Open your browser and navigate to:

http://<your-router-ip>:8088

• Default Username: admin
• Default Password: pulsegate

(Please change the password in pulsegate.toml for production deployments).

---

🛠️ Command Line Reference

Usage: pulsegate [OPTIONS] [COMMAND]

Commands:
  run       Run the transparent forwarding filter (default)
  check     Validate configuration syntax and system capabilities
  cleanup   Remove leftover rules after an unexpected reboot/shutdown
  rules     Manage and update downloaded rule subscriptions
  help      Print this message or the help of the given subcommand(s)

Options:
      --config <PATH>  Path to the pulsegate.toml configuration file
  -h, --help           Print help

Useful CLI Examples:

• Run in background (service):

  pulsegate --config /etc/pulsegate.toml run

• Manually trigger rule updates:

  pulsegate --config /etc/pulsegate.toml rules update

• Clean up lingering state:

  pulsegate cleanup

---

📑 Web Console Features

1. Runtime Telemetry: Monitor processed flows, active security rules, and wire-speed throughput rates in real time.
2. Live Decision Stream: Inspect connection verdicts (Allowed / Blocked), client LAN IPs, destination domains, and matching reasons.
3. Rule Subscriptions: View subscription source health, synchronization status, and trigger on-demand syncs.
4. Online Rule Editor: Quickly append domains, wildcard suffixes, or IP subnets to allowlists and blocklists with instant effect.