Strict validation & compiler
Validate the complete YAML schema offline and compile deterministic policy without network, filesystem or kernel access.
Block unwanted traffic at your Linux perimeter
Geographic filtering, ASN restrictions, CrowdSec bans, and IP blocklists - one focused blocking layer that works alongside your existing firewall.
No mandatory control plane. No separate firewall appliance. No need to route your traffic through someone else’s cloud.
>_Early runtime. Not production-ready yet.Follow the implementation plan →
perimeterd.yaml
V1 preview| 01 | version: 1 |
| 02 | |
| 03 | metrics: |
| 04 | listen: 127.0.0.1:2112 |
| 05 | |
| 06 | firewall: |
| 07 | backend: nftables # required: nftables or iptables |
| 08 | deny_action: drop # drop or reject |
| 09 | |
| 10 | global: |
| 11 | allowlist: |
| 12 | - 198.51.100.24/32 |
| 13 | |
| 14 | groups: |
| 15 | our_hq: [CZ, SK] |
| 16 | |
| 17 | policies: |
| 18 | - name: ssh-admins |
| 19 | priority: 10 |
| 20 | direction: ingress |
| 21 | mode: allowlist |
| 22 | traffic: ["22"] |
| 23 | include: |
| 24 | groups: [our_hq] |
| 25 | |
| 26 | - name: web-blocks |
| 27 | priority: 20 |
| 28 | direction: ingress |
| 29 | mode: blocklist |
| 30 | traffic: ["80", "443", "443/udp"] |
| 31 | include: |
| 32 | countries: [KP, IR, RU] |
| 33 | |
| 34 | crowdsec: |
| 35 | enabled: true |
| 36 | lapi_url: https://crowdsec.internal:8080 |
| 37 | api_key_file: /etc/perimeterd/credentials.d/crowdsec_api_key |
37 linesYAML
01 | Keep admin access narrow
In developmentAllow SSH only from the locations you choose.
02 | Protect public services
In developmentKeep your web public while blocking traffic that does not belong there.
03 | React to live threats
In developmentCombine static policy with CrowdSec decisions for dynamic ingress bans.
04 | Observability built-in
PlannedExpose Prometheus metrics for dropped packets, policy activity, and daemon health.
>_ SYSTEM PRINCIPLE
Resilient enforcement by design
perimeterd turns your policy into native nftables or iptables/ipset rules, with durable revisions that keep protection consistent across reloads, restarts, and backend changes.
What works today - and what remains for V1.
Implemented source-build capabilities, remaining runtime gates, and the delivery work required for the first production release.
Available · Policy
Country, ASN, RIR & group policy
Resolve RIPEstat-backed selectors, built-in regions and custom country groups from durable snapshots.
Ingress & egress, IPv4 & IPv6
Filter new inbound and outbound flows by protocol, port, selector and policy priority.
Direct IP & CIDR overrides
Apply global allowlists and blocklists before CrowdSec and geographic policy.
Available · Runtime
nftables + iptables/ipset
Enforce equivalent policy through either native backend, including migration between them.
CrowdSec dynamic bans
Synchronize ingress decisions into renewable kernel leases on either backend.
Durable revisions & recovery
Stage complete generations, preserve committed policy and recover journaled changes after restart.
Health gauges & native counters
Expose enforcement, CrowdSec and snapshot gauges while retaining backend-owned packet and denial counters.
Remaining · V1
Docker coexistence
Verify DOCKER-USER attachment order and preservation of Docker-managed firewall state.
Full Prometheus exporter
Collect and export processed and denied packet totals from native backend counters.
Installed service & packages
Ship tested systemd, tmpfiles, RPM and DEB install, upgrade, restart and removal lifecycles.
amd64 + arm64 release coverage
Complete native runtime and release verification across both target architectures.
Signed, automated releases
Gate and publish verifiable artifacts after compatibility, recovery and packaging checks pass.
From policy intent to kernel enforcement.
perimeterd validates the complete configuration, resolves required selectors into one immutable snapshot, compiles backend-neutral policy, and commits it through a single serialized writer.
Configperimeterd.yaml
→Step 1Strict validation
→Step 2Immutable snapshot
→Step 3Policy compiler
→Step 4Serialized commit
→Backendnftables / iptables+ipset
→EnforcementLinux kernel
CrowdSec LAPI→Dynamic decision store→[joins at serialized writer]
Native enforcement. No traffic proxy.
perimeterd writes owned nftables or iptables/ipset state directly on the host. Application traffic never passes through the daemon.
>_
Complete candidates only
Configuration, source data, runtime resources and backend preflight are complete before a revision can commit.
>_
One serialized writer
Static policy, source refreshes and CrowdSec decisions share one ordered mutation path.
>_
Durable by design
Checksummed revisions, journals and active records make enforcement recoverable across restarts.
>_
Precise ownership
perimeterd records and changes only its own firewall targets while preserving unrelated host state.
Built for real Linux infrastructure.
Host-level protection for one server or an entire Linux fleet.
>_
Protect a public VPS
Add geographic, ASN, CrowdSec, and direct address policy without replacing the firewall that already permits your services.
>_
Lock down administrative access
Limit SSH and other management services to the networks, locations, or reusable groups you trust.
>_
Harden load balancers and edge hosts
Apply ingress policy at the Linux firewall before unwanted new flows reach the services behind the host.
>_
Control outbound traffic
Restrict where services may connect using country, group, RIR, ASN, or direct IP/CIDR policy.
Open source. Run it yourself. Keep it yours.
perimeterd is MIT-licensed. Inspect it, fork it, automate it, and build the daemon for your own Linux infrastructure. The open-source runtime does not require a commercial control plane.
Help us keep building in the open.
perimeterd is part of the Distro Ops open-source and commercial ecosystem. Partners help fund long-term development while the projects remain freely available under their open-source licenses.
Partners
Visibility across the Distro Ops ecosystem, including project websites, README files, and the central partner page.
Partner Slot #2
Partner Slot #3
Distro Ops Control Plane
Coming soonCentralized policy and fleet management for perimeterd.
Managing perimeterd across more than one host? The planned Control Plane will centralize policy, inventory, revisions, and staged rollouts while every daemon continues enforcing locally.
It will build on perimeterd’s durable revisions and health signals without putting application traffic in the control path.
Central policyFleet inventoryPolicy revisionsStaged rolloutsEnforcement health
Want to shape where it goes?
We’re designing the Control Plane now. If you manage Linux infrastructure at scale and want to influence the roadmap, let’s talk.
Frequently Asked Questions
Does perimeterd require a cloud service?
No. Configuration, policy compilation, firewall enforcement, state and metrics stay on the Linux host. Country and ASN selectors refresh from the public RIPEstat API and cache committed snapshots locally. CrowdSec is optional and uses the LAPI you configure.
Which firewall backends are supported?
Both nftables and iptables/ipset are implemented. They share the same policy compiler, durable revision model, CrowdSec leases, native accounting and backend-migration contract. Docker-specific coexistence verification remains a V1 release gate.
What can I express in a policy?
Policies support direct IP and CIDR overrides, countries, ASNs, RIR service regions, built-in regions and custom country groups. You can combine allowlist or blocklist mode with priority, ingress or egress direction, IPv4 or IPv6, protocol and ports.
Will perimeterd replace or flush my existing firewall?
No. perimeterd changes only its owned tables, chains, sets, counters and tagged attachment jumps. Unmatched or allowed traffic returns to the surrounding firewall, which remains responsible for permitting services and ports.
Does perimeterd integrate with CrowdSec?
Yes. The optional CrowdSec integration synchronizes authoritative ingress decisions to either backend. Bans are installed as finite, renewable kernel leases rather than permanent firewall rules.
How should I interpret country filtering?
RIPEstat country data reflects address allocation or registration, not a device’s physical location. VPNs, hosting networks, mobile carriers, address transfers and routing changes can make policy results differ from a user’s actual location.
Is perimeterd production ready?
Not yet. The core source-build runtime is implemented, including both backends, source-backed policy, CrowdSec and durable recovery. Docker verification, full metrics export, installed services and packages, amd64 and arm64 release coverage, and signed releases remain V1 gates.
Is perimeterd a Web Application Firewall (WAF)?
No. perimeterd filters new network flows at the Linux firewall layer using remote addresses, protocols and ports. It does not inspect HTTP, TLS or application payloads, and can operate alongside a WAF.