Gatekeeper deliberately exposes the traffic (DNS queries & live traffic stats) that goes through the router to all LAN members. While this may seem creepy, the same data may also be intercepted by:

• Malicious IoT devices, smartphone apps & PCs that are connected to your home network
• ISPs
• IXPs (Internet Exchange Points)
• VPNs
• TOR exit nodes

This is a systemic issue and it's severity grows with lack of public awareness. Gatekeeper aims to fix that. It's empowering regular users to do the same thing that is currently done secretly by public institutions & dodgy businesses.

Example

Alice, a journalist, assumed that her VPN will keep her whistleblowers safe. Eve, who runs the VPN company has great fun snooping on what Alice has been up to. Evan who works as an analyst in the police cybercrime department, recently got a bonus for tracking down Alice's whistleblowers from the IXP traffic.

After installing Gatekeeper, Alice learned what information she leaks online. Instead of dodgy VPNs she switched to end-to-end encryption for her online activity. As a result neither Eve nor Evan could snoop on Alice's communication any more.

The original intent for Gatekeeper was to get a picture of what IoT devices are connected to the network & what they're doing. Gatekeeper gives you an overview of all devices connected to your network & their real-time network activity:

• What devices are even present in the network? (MAC, IP, hostname)
• What are they doing? (DNS queries, traffic summary & live traffic graphs for each domain)

Gatekeeper is a single executable file that configures itself automatically, updates itself every week & automatically restarts itself in case of a hangup or a crash. Once installed it should never require any interaction.

Because Gatekeeper can assume that it's being used as a home gateway it can avoid any sort of manual configuration.

Gatekeeper is also stateless - meaning that it doesn't store any data on disk. If anything goes wrong, a simple restart (which is also fully automated) will always fix it.

Gatekeeper provides best-in-class connectivity for LAN clients thanks to its ability to perform Full Cone NAT. It means that your PCs will have an easy time establishing direct connections with other PCs on the Internet. This is extremely useful for peer-to-peer applications such as video calls, file sharing or gaming.

Some may say that it exposes your devices to the Internet but that's actually not true - only the specific ports that your devices use for outgoing connections will be redirected back to them. Listening ports will remain closed.

Generally speaking Gatekeeper needs to sit between your LAN network and the internet. It can either completely replace the router provided by ISP, or sit between the ISP router and your LAN network. Although replacing the ISP router allows you to reduce the number of computers and total power usage, it may be more complicated. Some ISPs perform MAC filtering to limit access to their network. Quite often it's possible to bypass it by cloning the MAC address of the ISP router but that would go a little beyond the scope of this guide. Feel free to try this out as an exercise though! Here we'll cover the case where Gatekeeper is used to "isolate" the ISP router from your LAN network.

The machine that will run Gatekeeper will need at least two Ethernet ports. One for the Wide Area Network (WAN) side and one for Local Area Network (LAN) side. Probably more - depending on how many LAN clients you'd like to connect directly. If your machine has only one ethernet port (which is almost always the case) you can always just buy an USB ethernet adapter to add the second one. It may be a good idea to also buy an Ethernet Switch (new ones can be bought from Amazon for less than $20) since they're more cost-efficient than a bunch of USB ethernet adapters.

There is also the question of Wireless connectivity. As of now Gatekeeper doesn't configure the Wireless LAN, but if you're more experienced with Linux you may use wpa_supplicant to set up a network. Once the wireless settings are in place, Gatekeeper will gladly manage it. You can also spend some cash on Wireless Access Point (make sure it's a "dumb" access point - not a "router") and turn any regular ethernet port into wireless one.

Ok, so with all the requirements in place, what are our options for hardware?

The first and most obvious one is any spare laptop (or PC) that you have laying around. With a simple Ethernet USB adapter you can plug it between your ISP router & your LAN network. You can also look online for used laptops. Computer hardware drops in value very fast so you may find pretty good deals online. Be careful about power usage though - a cheap PC may actually cost you more in power bills than the hardware itself. Generally speaking laptops are not a problem - they rarely draw more than 20 W - but it's good to do your math and account for power bills when buying new stuff.

The second option is to get a single board x86 computer. Single board computers, often called SBCs, are the most compact form of a general purpose computer. They look similar to appliances and don't have as much upgrade potential as regular PCs or laptops but otherwise they're not much different. Being compact and power efficient is good for a machine that will run all the time. The "x86" part indicates the type of computer that Gatekeeper can run on. Some SBCs are marked as "ARM". Gatekeeper is in the process of adding ARM support though - so for the time being better avoid them and find an x86 SBC. To find them you can google "x86 sbc". My personal choice was https://eu.protectli.com/. They're on the expensive side and technically speaking they're not SBCs but they can also handle much more than Gatekeeper. I've been pretty happy with my 4-port VP2420, which I also use to host my website.

Overall if you're a beginner I'd recommend trying out the laptop approach. SBCs doesn't have a screen or a keyboard which makes them a little more troublesome during setup. If anything goes wrong, investigation is much easier when you can just pop open a laptop vs carrying a monitor laptop to see why SBC can't be reached over the network.

Ok, so with the hardware in place, we can start setting up the OS!

Gatekeeper will happily run on any 64-bit Linux. Feel free to skip this section if your machine already has one installed.

There are many flavors of Linux, depending on what you want to use your computer for. Most people go for Ubuntu because of it's polished experience and popularity. For a server machine I'd actually recommend Debian. Under the hood it's very similar to Ubuntu so most of the guides for Ubuntu will work on Debian. Debian is also known for being boring but boring is a good thing when it comes to servers. Security issues are very rare and things generally don't change much between versions.

So without further ado let me redirect you to another guide, which will explain how to install Debian: https://www.debian.org/releases/bookworm/amd64/.

This step may take quite a bit of time if you're new to Linux. Once you know the drill, it's ~5 minutes of manual work and 15 minutes of waiting for the installation to finish.

Once you're done with the installation, we can finish the process by testing & installing Gatekeeper!

Ok, we've wasted enough time already for all this setup so let's get this one out of the way quickly.

Copy this command and run it in terminal:

curl -L https://github.com/mafik/gatekeeper/releases/latest/download/gatekeeper.x86_64 -o gatekeeper \
  && chmod  x gatekeeper \
  && sudo ./gatekeeper

That's it. The first part of the command will grab the latest Gatekeeper release from GitHub, the second one will make it executable and the final one will run it with administrator's privileges.

During startup Gatekeeper will search for any unconfigured network interfaces turn them into a LAN network. It can be stopped at any time by pressing Ctrl C in the terminal window.

You can open the URL printed on the command line (usually http://10.0.0.1:1337/) to see the web interface. It's also accessible from any computer in your LAN network.

Did you got an error like this?

Couldn't find any candidate interface (src/gatekeeper.cc:###).

By default Gatekeeper will manage only the interfaces without IP addresses. It your LAN interface is already configured you can either clear its IP it with sudo ip addr flush dev <interface> or tell Gatekeeper to use it as-is by running Gatekeeper with LAN=<interface> environment variable.

You can also pass multiple space-separated interface names in the LAN variable. Gatekeeper will connect them into a single LAN network. This can be handy if you're using multiple USB ethernet adapters or you're lucky enough to have a machine with multiple ethernet ports.

LAN="eth0 eth1 wlan0" ./gatekeeper # connect eth0, eth1 & wlan0 into a single LAN network

If Gatekeeper was already installed (you completed the next step), this can be easiest done by running sudo systemctl edit gatekeeper and adding the following lines:

[Service]
Environment="LAN=<interface>"

To permanently install Gatekeeper, press the Install button in the web interface.

To understand what's going under the hood you should be aware of a software called systemd. It's a program that manages background tasks on modern Linux machines. During installation Gatekeeper will copy itself to /opt/gatekeeper/, and register itself as a systemd service. Thanks to systemd Gatekeeper will not only autostart on every boot, but also restart itself in case of a crash or a hangup.

After installation you may remove the downloaded binary with rm gatekeeper. Gatekeeper copied itself over to /opt/gatekeeper/ so it's no longer needed.

If you've seen a page with an installation log then it means that the process completed successfully. 🎉🎉 Congrats!

To remove Gatekeeper, run sudo systemctl disable --now gatekeeper (this stops Gatekeeper and prevents it from starting again on next reboot). Also run sudo rm -rf /opt/gatekeeper to remove any installed files.

Install most recent LLVM & development tools with:

sudo bash -c "$(wget -O - https://apt.llvm.org/llvm.sh)"
sudo apt install -y inotify-tools