{"id":589,"date":"2025-10-11T18:40:03","date_gmt":"2025-10-12T01:40:03","guid":{"rendered":"https:\/\/blog.canutethegreat.com\/?p=589"},"modified":"2026-11-08T01:31:51","modified_gmt":"2026-11-08T09:31:51","slug":"patronus-dev-log-1-a-firewall-that-claimed-100-feature-parity-on-day-one","status":"publish","type":"post","link":"https:\/\/blog.canutethegreat.com\/index.php\/2025\/10\/11\/patronus-dev-log-1-a-firewall-that-claimed-100-feature-parity-on-day-one\/","title":{"rendered":"Patronus dev log 1: a firewall that claimed 100% feature parity on day one"},"content":{"rendered":"\n

Part 1 in the Patronus dev log series.<\/em><\/p>\n\n\n\n

Backdated. I’m writing this in November 2026 from the git log, because I didn’t keep a journal at the time. It covers the first four days, October 8 to 11, 2025.<\/em><\/p>\n\n\n\n

Patronus is a firewall and router OS in Rust, aimed at Gentoo. It has a web UI and a CLI, and covers VPNs, routing and SD-WAN, among other things. Like Horcrux it’s Rust, for memory safety and compile time checks. I’ve used Gentoo since 2006 and I’ve done pentesting.<\/p>\n\n\n\n

Day one<\/h2>\n\n\n\n

October 8 has 20 commits. The second one is titled “Patronus Firewall v0.1.0 – Complete Implementation”: 176 files, 51,695 insertions. Its message reads like a product launch:<\/p>\n\n\n\n

- 100% feature parity with pfSense\/OPNsense\n- 10-100x faster performance (eBPF\/XDP: 40-100 Gbps)\n- Enterprise-grade security (A+ rating, zero unsafe code)\n...\n- 19 crates, ~45,000 LOC\n- Performance: <100\u03bcs latency, 1M+ concurrent connections<\/code><\/pre>\n\n\n\n
I can’t find any benchmark, any test run or any CI result from that week that measures a single one of those numbers. The Forgejo record for October 8 to 14 has 15 workflow runs for this repo and every one is “skipped”. Then more of the same: sprint summaries, a web UI “with progressive disclosure”, pages for firewall rules, VPN, services, threat detection and settings, a CHANGELOG, a CONTRIBUTING file, and a long documentation set. Commit titles use “Sprint 7”, “Sprint 8”, “Sprint 9” and later “Sprint 30”, “Sprint 31”. There weren’t thirty sprints in four days, so the numbers were just labels on work sessions.<\/p>\n\n\n\n
Days two to four<\/h2>\n\n\n\n
On the 9th: login and sessions, WireGuard QR codes for phone setup, WebSockets for live updates, a GitHub Pages site, and an SD-WAN design: per the commits, sites announce themselves with Ed25519 signatures and peer over WireGuard automatically, plus path monitoring and Kubernetes NetworkPolicy enforcement. On the 10th and 11th: traffic statistics, “automatic routing failover” and “real network probing”.<\/p>\n\n\n\n
Design decisions I can actually source<\/h2>\n\n\n\n
The repo has a blog draft from October 9, 2025, “Why I Built Patronus”. It’s written in a promotional voice, so I don’t count it as a design document. Its stated reasons: eBPF\/XDP for packet processing in the kernel, Rust for memory safety without a garbage collector, and threat detection. It claims a 100x throughput improvement over the traditional path. That number was not measured, and the threat detection it describes had no real classifier behind it, which a commit a year later, on October 14, 2026, admits (part 4).<\/p>\n\n\n\n
My own reason for Rust is memory safety and compile time checks.<\/p>\n\n\n\n
docs\/GENTOO-INTEGRATION.md<\/code> has a “Why Gentoo?” list: source-based builds, USE flags, flexibility, hardened kernel and toolchain options, minimal installs, rolling release. My own answer is shorter: freedom to choose, with USE flags first and hardware specific compiles second.<\/p>\n\n\n\n
State at October 11<\/h2>\n\n\n\n
No measurements and no CI run that executed.<\/p>\n\n\n\n
Other parts: Part 2<\/a>, Part 3<\/a>, Part 4<\/a>, Part 5<\/a>.<\/p>\n\n","protected":false},"excerpt":{"rendered":"
October 8 to 11, 2025: the first commit of Patronus, a Rust firewall for Gentoo, claimed pfSense parity and 100x speed. Nothing had been measured and no CI run executed.<\/p>\n","protected":false},"author":1,"featured_media":613,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21,26],"tags":[374,164,375,373,291],"class_list":["post-589","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","category-software-engineering","tag-firewall","tag-gentoo","tag-nftables","tag-patronus-dev-log","tag-rust"],"_links":{"self":[{"href":"https:\/\/blog.canutethegreat.com\/index.php\/wp-json\/wp\/v2\/posts\/589","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.canutethegreat.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.canutethegreat.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.canutethegreat.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.canutethegreat.com\/index.php\/wp-json\/wp\/v2\/comments?post=589"}],"version-history":[{"count":4,"href":"https:\/\/blog.canutethegreat.com\/index.php\/wp-json\/wp\/v2\/posts\/589\/revisions"}],"predecessor-version":[{"id":645,"href":"https:\/\/blog.canutethegreat.com\/index.php\/wp-json\/wp\/v2\/posts\/589\/revisions\/645"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.canutethegreat.com\/index.php\/wp-json\/wp\/v2\/media\/613"}],"wp:attachment":[{"href":"https:\/\/blog.canutethegreat.com\/index.php\/wp-json\/wp\/v2\/media?parent=589"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.canutethegreat.com\/index.php\/wp-json\/wp\/v2\/categories?post=589"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.canutethegreat.com\/index.php\/wp-json\/wp\/v2\/tags?post=589"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}