v2.3.0

Highlights

This release reworks the easywall web interface from the ground up. The hand-rolled CSS components have been replaced with DaisyUI 5.5 primitives, HTMX 2.0 powers a new generation of in-place interactions, and the visual palette has been redesigned for cohesion.

A new color concept

The previous orange-on-navy combination was complementary — striking, but visually noisy. The new "Aurora Operator" palette uses analogous cool tones throughout: deep slate-blue chrome with cyan-400 / teal-400 accents in dark mode, or white with cyan-600 / teal-600 in light mode. Status colors (emerald, amber, rose, sky) stay clearly distinct from the accent.

Live validation everywhere

Three editors now validate input as you type:

• Custom rules (/custom) — nft --check runs server-side via POST /custom/validate, per-line syntax errors surface inline
• Blacklist & whitelist (/blacklist, /whitelist) — net.ParseIP / net.ParseCIDR validate every line via the shared POST /iplist/validate
• All editors fall back to a soft notice when the core daemon is offline

Auto-save and toast feedback

The Options, Network, and System pages no longer require clicking Save. Toggle a switch or change a numeric input and the form posts in the background; a small toast in the bottom-right confirms ("Saved" / "Save failed"). The Save button is preserved for graceful degradation when JavaScript is disabled.

Audit log filter

The audit log page now has a search box that filters rows live (case-insensitive substring across action / rule type / detail / user) via GET /log/filter.

Component overhaul

All 15 templates were migrated to DaisyUI primitives — cards, buttons, alerts, fieldsets, toggles, tables, badges, tabs, steps. The custom CSS in web/src/app.css now contains only layout-specific chrome (sidebar, topbar, auth pages, status dots, audit log action tags).

Fixed

• Custom rules in state.Current.Custom are now actually applied to the nftables kernel after the typed-rules flush

Compatibility

No breaking changes. Configuration files, IPC protocol, and on-disk state are compatible with v2.2.0.

Full changelog

See CHANGELOG.md for the complete list, or browse the v2.2.0…v2.3.0 diff.

🤖 Generated with Claude Code

v2.2.0

What's new in v2.2.0

Added

• Audit log viewer (GET /log) — the core's per-change audit.log is now accessible from the web UI in a table showing timestamp, action, rule type, detail, and user; most-recent entries first (up to 200 entries)
• Dashboard rule-count cards — TCP port count, UDP port count, blocked IPs (blacklist), and allowed IPs (whitelist) are now shown as stat-cards on the dashboard, each linking to the relevant management page
• GET/POST /system — acceptance window duration and enabled flag are now configurable from the web UI without editing easywall.toml

---

Full changelog: https://github.com/jp1337/easywall/blob/main/CHANGELOG.md

v2.1.0

Changelog

Features

• 14c5d55: feat(auth): add GET/POST /password route for changing the admin password (@jp1337)
• 4c68a15: feat(options): make firewall options editable from the web UI (@jp1337)
• 108e8ab: feat(options): sync option-icon on/off class when toggle changes (@jp1337)
• d21a294: feat(settings): add GET/POST /settings for IPv6 and Docker network config (@jp1337)

Bug Fixes

• eb79e92: fix(apply): keep polling after accepted state — backend resets to idle immediately (@jp1337)
• 72c231d: fix(lint): gofmt alignment in protocol.go const block (@jp1337)
• a2f4bdd: fix(web): add CSP nonce to auth templates and expand nonce test coverage (@jp1337)
• c513594: fix: IPv6 blacklist/whitelist + remove CSP unsafe-inline (@jp1337)

Other

• ac7f791: chore(release): v2.1.0 (@jp1337)
• 54e942c: chore(web): remove unused htmx CDN script (@jp1337)
• 5ec258a: test(core): improve unit-test coverage for Start and NewFirewall (@jp1337)
• 7fedbe2: test(core): skip read-only dir test when running as root (@jp1337)
• 0d15b0a: test: update integration tests for IPv6 rule support (@jp1337)

v2.0.0

Changelog

Security

• 88e4378: security: replace gorilla/csrf with net/http.CrossOriginProtection (jpylypiw 12394156+jpylypiw@users.noreply.github.com)

Features

• 82e181f: feat(ci): wire CODECOV_TOKEN and add coverage badge to README (jpylypiw 12394156+jpylypiw@users.noreply.github.com)
• cf50bb9: feat(docs): custom design — GitHub-dark palette, IBM Plex Sans, cyan accent (jpylypiw 12394156+jpylypiw@users.noreply.github.com)
• 79ce73a: feat: add JSON Schema validation for TOML config files (jpylypiw 12394156+jpylypiw@users.noreply.github.com)
• 9a0760d: feat: add easywall logo — flame silhouette with brick wall pattern (jpylypiw 12394156+jpylypiw@users.noreply.github.com)
• fbc40d6: feat: roll out logo to all surfaces (jpylypiw 12394156+jpylypiw@users.noreply.github.com)
• 1b9a913: feat: v2.0.0 complete rewrite in Go with nftables backend (jpylypiw 12394156+jpylypiw@users.noreply.github.com)

Bug Fixes

• 04445da: fix(ci): add id-token: write permission for Codecov OIDC auth (jpylypiw 12394156+jpylypiw@users.noreply.github.com)
• d4a0d4c: fix(ci): build golangci-lint from source to support go1.25 (jpylypiw 12394156+jpylypiw@users.noreply.github.com)
• 95de072: fix(ci): move .deb to dist/ before upload — relative paths not allowed (jpylypiw 12394156+jpylypiw@users.noreply.github.com)
• 323d200: fix(ci): skip Debian build dep check and tests in CI (jpylypiw 12394156+jpylypiw@users.noreply.github.com)
• cfbfcd5: fix(ci): upgrade Go to 1.25 in all workflows (jpylypiw 12394156+jpylypiw@users.noreply.github.com)
• 036e76a: fix(ci): use actions/deploy-pages for GitHub Pages (workflow build type) (jpylypiw 12394156+jpylypiw@users.noreply.github.com)
• f2ba15d: fix(ci): use golangci-lint v1 config format (remove version: 2 key) (jpylypiw 12394156+jpylypiw@users.noreply.github.com)
• 6fd1e9c: fix(core): guard nftables nil-conn, fix docker CIDR masking, recover apply panics (jpylypiw 12394156+jpylypiw@users.noreply.github.com)
• 4d32a2b: fix(docs): correct header visibility in light and dark mode (jpylypiw 12394156+jpylypiw@users.noreply.github.com)
• 4457767: fix(docs): respect system dark mode preference in MkDocs Material (jpylypiw 12394156+jpylypiw@users.noreply.github.com)
• 13bf786: fix(lint): gofmt formatting and remove unused currentUser method (jpylypiw 12394156+jpylypiw@users.noreply.github.com)
• 94ec62c: fix(lint): resolve all golangci-lint errors (jpylypiw 12394156+jpylypiw@users.noreply.github.com)
• 8e7b306: fix(release): add QEMU and Buildx for arm64 Docker cross-build (jpylypiw 12394156+jpylypiw@users.noreply.github.com)
• c85e2b5: fix(release): add source files to GoReleaser docker extra_files (jpylypiw 12394156+jpylypiw@users.noreply.github.com)
• fe41d40: fix(release): correct dockers_v2 schema fields (jpylypiw 12394156+jpylypiw@users.noreply.github.com)
• 903551b: fix(release): remove stale MkDocs deploy job (jpylypiw 12394156+jpylypiw@users.noreply.github.com)
• 522dced: fix: add missing cmd/ source dirs to git, fix lint and formatting (jpylypiw 12394156+jpylypiw@users.noreply.github.com)

Other

• 7260aee: chore(release): v2.0.0 (jpylypiw 12394156+jpylypiw@users.noreply.github.com)
• 303f357: chore: fix FUNDING.yml with correct ko-fi and add GitHub Sponsors/PayPal (jpylypiw 12394156+jpylypiw@users.noreply.github.com)
• c3f397b: chore: migrate GoReleaser docker config to dockers_v2 (jpylypiw 12394156+jpylypiw@users.noreply.github.com)
• 1de4ba9: chore: rename GitHub username jpylypiw → jp1337 across entire codebase (jpylypiw 12394156+jpylypiw@users.noreply.github.com)
• 618a673: chore: update web templates and documentation (jpylypiw 12394156+jpylypiw@users.noreply.github.com)
• 4c1b136: ci: add integration test job, build workflow, update Go to 1.25 (jpylypiw 12394156+jpylypiw@users.noreply.github.com)
• cebea9e: refactor: make internal functions overridable for test isolation (jpylypiw 12394156+jpylypiw@users.noreply.github.com)
• 195ba62: test(core): add comprehensive unit and integration test suite (jpylypiw 12394156+jpylypiw@users.noreply.github.com)
• ebe73ec: test(shared): extend version check tests (jpylypiw 12394156+jpylypiw@users.noreply.github.com)
• 3e0ab1e: test(web): add comprehensive handler and server test suite (jpylypiw 12394156+jpylypiw@users.noreply.github.com)
• 484b717: test: cover SaveRules marshal error and CSRF deny handler (jpylypiw 12394156+jpylypiw@users.noreply.github.com)
• 6412de5: test: cover Server.Start/Stop lifecycle and NewDaemon integration (jpylypiw 12394156+jpylypiw@users.noreply.github.com)

v0.3.1 - Fix issue #26

Changed

• Remove --show-progress from shell scripts and fix issue #26

v0.3.0 - Rules Handler redesigned

Added

• Ports can now have a description. In future versions you will be able to edit this description. Currently you can only delete the port and add a new description.
• CodeQL analysis of GitHub enabled. This is a beta test of Github.
• Python tests prepared for Python 3.9
• It is now recognized when adding a port, if it is already present.
• A new pip3 module pyyaml is now required. This should be installed automatically during the update.

Changed

• Ports page in the web interface visually redesigned for the new port description
• The update script no longer updates to the master branch, but to the last release
• The Feature-Policy HTTP Header is deprecated and was replaced by Permissions-Policy.
• Buffer overflow problem solved with very large HTTP header in request
• Problem solved, if values were written in capital letters in the configuration
• Tests rewritten for use with the new Rules Handler

Removed

• Rules are no longer stored in the rules folder but in config/rules.yml. The folder structure under rules can therefore be deleted. There is no import of old rules, because easywall is still in beta status.

v0.2.4 - First Run Wizard

Added

• Security headers of the demo page are checked for correctness and actuality.
• Information about what to do after the installation of easywall to adjust the access data.
• Class documentation automatically generated and added to the dosc folder
• If no user name and password is set in the configuration file, the First Run Wizard is automatically displayed in the web interface
• After saving the options in the web interface, the tab you saved will be displayed.
• Login attempts and the lockout time for too many failed logins can now be configured under "Web Interface".
• bindip and bindport option with the info that these are debug variables

Changed

• The bindip and bindport options have been replaced by the UWSGI start parameters
• Error messages when saving the options are now displayed correctly
• Fixed several errors when starting the web interface in debug mode

v0.2.3 - Bugfixes

Changed

• Problems with the installation fixed
• Installation guide improved
• Problems at startup under Ubuntu 18.04 solved

v0.2.2 - tiny security release

Added

• Readme and documentation improved
• Added quick start guide to documentation
• APT package and repository guide added to installation documentation
• New security and general HTTP headers added
• Installation shellscripts strongly improved

Changed

• Inline Javascript moved to separate file

v0.2.1 - Easier to install

Added

• easywall is now also available as installable Debian package
• easywall is now also available on pypi and can be installed over it
• Massive improvement of GitHub workflows
• Improve automated testing through GitHub workflows
• There is now an FAQ documentation, which will be filled with time
• The web server now sends headers to harden the application such as no permission for frames
• 403 Error page added and web errors generally improved
• The web configuration is now also checked for missing entries
• flask-ipban dependency added
• pypi package information improved and completed
• Unit Tests significantly improved and the tools for Core and Web Tests combined

Changed

• After 10 incorrect login attempts on the web interface by default, the attacker address is blocked
• The log settings were moved to a separate configuration file "log.ini" in the "config" folder
• The SSL settings were hardened - only current browsers can be used
• The easywall_web folder was moved to the easywall folder as "easywall/web