WolfRouter

A native cluster-wide router, firewall, DHCP server, DNS resolver, packet sniffer, and live rack diagram — all built into WolfStack. Replaces the classic "run OPNsense in a VM" pattern with something that lives on the host and knows about every node, VM, and container.

This page is written for two audiences. If you already know networking, skip to What you get. If routers, DHCP, and DNS are a fog to you, start at The basics — five concepts and you'll understand everything else on this page.

What is a router, really?

A router is a traffic cop for packets. Every device on your network — laptop, phone, fridge, that weird IP camera — sends packets to the router, and the router decides where each one goes next. The internet, another machine on your LAN, a neighbour's Wi-Fi, or the bin.

A home router (the box from your ISP) does four jobs in one appliance:

WolfRouter is those four jobs, done by your server instead of a dedicated box — with a nice UI on top so you never have to edit /etc/dnsmasq.conf or hand-type an iptables rule.

The basics — five concepts, and everything else follows

Once these five clicks into place, every screen in WolfRouter is readable. Skim the table, come back to it if something stops making sense later.

Two more terms that WolfRouter uses heavily:

• Zone — a label you stick on an interface (WAN, LAN 0, WolfNet, DMZ, Trusted). Rules are written in zone terms — "allow LAN 0 → WAN" — so you never have to remember whether enp3s0 is the inside or the outside port today. Swap the cable, relabel the zone, every rule still makes sense.
• Firewall rule — "allow", "deny", or "reject" traffic matching a pattern (source zone, destination zone, protocol, port). A default-deny router blocks everything except what the rules explicitly allow; a default-allow router (WolfRouter's default) permits everything except what you block.

Why WolfRouter exists

The traditional homelab pattern is to run OPNsense or pfSense as a VM on top of your hypervisor. It works, but it has three uncomfortable properties:

• The firewall sits inside one of the things it's supposed to govern. Your hypervisor is both the host and the firewalled guest. That's architecturally upside-down.
• The WAN and LAN cables have to go through the hypervisor's networking before they reach the firewall VM. That's a lot of rope to tangle, and often involves VLAN passthrough quirks.
• You end up managing two separate worlds: the firewall lives over there (its own UI, its own users, its own updates), and your VMs/containers live over here.

WolfRouter takes the opposite approach. The router is the host. It knows about every WolfStack node, every VM, every container, every bridge. It exposes the whole stack — physical NICs, bridges, WolfNet overlay, WireGuard, port forwards — in one cluster-aware view. No VM, no passthrough, no separate login.

What you get

Stateful firewall with zones

• Define WAN / LAN / DMZ / WolfNet / Trusted zones (or roll your own custom ones), assign interfaces to them, then write rules in zone-to-zone terms.
• Rules compile to iptables in dedicated WOLFROUTER_* chains so existing Docker, LXC, and DNAT rules stay untouched.
• Atomic apply with safe-mode: every ruleset goes through iptables-restore --test before swap. A 30-second rollback timer auto-reverts the change if you don't confirm — no more locking yourself out of SSH after a typo.
• Rule editor with structured pickers: pick a source and destination by kind (Any / Zone / LAN / Interface / IP / VM / Container) with dropdowns sourced from live topology. You never type an interface name.

Per-LAN DHCP + DNS via dnsmasq

• One dedicated dnsmasq instance per LAN segment, bound strictly to that interface.
• DHCP pool ranges, MAC-pinned reservations, custom lease times, live lease table.
• DNS forwarder presets: Cloudflare, Google, Quad9 (malware filter), OpenDNS, AdGuard (ad/tracker block), or custom.
• Local A records for giving VMs friendly hostnames without an external DNS server.
• Per-LAN query logging on demand — watch real client queries arrive in real time.

WAN connections

• DHCP — the normal "your ISP router hands out an address" case. WolfRouter just installs NAT; the existing host DHCP client does the rest.
• Static — for business lines with a fixed IP.
• PPPoE — fully managed. For ADSL/VDSL/fibre in Germany (Telekom, Vodafone), UK (BT), France (Orange) and elsewhere where the ISP requires a PPPoE login. WolfRouter writes the pppd peers file and PAP/CHAP secrets (mode 0600, root-only), auto-installs ppp + pppoe packages, brings the link up, and surfaces live status on each card.

⚡ Quick Setup wizard

• Assign WAN and LAN zones in the Zones tab, click Quick Setup, review the plan, click Run setup. Done.
• Auto-installs dnsmasq + iptables preflight (on apt/dnf/yum/pacman/zypper), creates the DHCP-mode WAN, assigns the router IP to the LAN interface, brings the interface up, creates the LAN segment, applies the firewall, verifies DNS bind — every step reported with ✓, ⚠, or ✗ inline.
• Offers six DNS provider presets at the top of the wizard so you never type a forwarder IP.

🛠 DNS Tools tab

• LAN-side DNS health — toggle per-LAN dnsmasq query logging, see arriving client queries in real time, and capture 10 seconds of UDP port 53 traffic on the LAN interface. Answers "is my client's query actually reaching dnsmasq?" instead of the usual guessing.
• Host-side tools — ping, traceroute, nslookup, whois. One-click install of any missing tools via the host's package manager (picks the right per-distro package name automatically: dnsutils on Debian, bind-utils on Fedora, bind on Arch, etc).

💾 Config export / import

• Back up your entire WolfRouter setup (zones, LANs, WAN connections, firewall rules, global toggles) to a single JSON file with one click.
• Restore onto the same node, or clone onto another node. PPPoE passwords are masked as "***" on export (safe to share the file), and preserved on import if you're restoring to the same box.

Live diagnostics

• Packet capture — Wireshark-style: pick a node, an interface, optionally a BPF filter (tcp port 443, icmp, host 8.8.8.8), choose a packet count and timeout. Streams back parsed into a coloured table by protocol. tcpdump auto-installed on first use.
• Connection tracking viewer — live conntrack output sorted by proto, source, destination, state, timeout.
• Firewall log stream — rules tagged with "Log this match" send to NFLOG and surface in a live tail.
• Policy map — drag-and-drop graph of your current rules + port forwards. Click a node to trace connections, drag between nodes to create a new rule.
• Visual TraceRoute — trace the path from any cluster node to any destination and see each hop rendered visually with latency. Diagnostics surface inline below the network diagram.

Subnet routing across the mesh New

• Advertise LAN and Docker subnets across WolfNet — expose any local subnet (e.g. 10.10.10.0/24, a Docker bridge, a Proxmox vmbr) to every other node on the mesh. Tailscale-style "subnet routes", but built in.
• Kernel routes applied at runtime — no reboot, no manual ip route. Add or remove a subnet route in the UI and the kernel routing table updates immediately on every cluster node.
• Gateway-side firewall plumbing — the gateway node automatically enables IP forwarding, adds bidirectional FORWARD ACCEPT rules, sets POSTROUTING MASQUERADE for return traffic, and disables reverse-path filtering on the WolfNet interface.
• Built-in diagnostics — one click runs five checks (forwarding enabled, FORWARD rules present, MASQUERADE present, rp_filter loose, kernel route installed) and tells you exactly which one is missing if traffic isn't flowing.
• Node picker UI — pick which node owns the subnet from a dropdown of cluster members; the rest follows automatically.

Cluster replication

• Every rule, LAN, zone, and WAN config change automatically syncs to every other online cluster node via the cluster secret. Nothing to push by hand.
• The view is cluster-scoped: peers from other clusters are hidden, and a small "N nodes hidden" note explains why.

Your first setup in five minutes

Assumes: you've installed WolfStack, you have two Ethernet interfaces (one to your modem, one to your home switch), and you want WolfRouter to replace or sit beside your existing router.

⚠ Before you start: shut down any other DHCP server on the LAN you're about to manage. OPNsense, pfSense, a home router's DHCP, another WolfRouter — they'll all compete and cause clients to get random leases. One DHCP per broadcast domain.

1. Open WolfRouter. Sidebar → your cluster → WolfRouter. You'll see the rack view of your cluster with every interface as a port.
2. Assign zones. Switch to Table view → Zones. Use the dropdown on each row:
   • The interface plugged into your modem/ONT → WAN
   • The interface plugged into your home switch → LAN 0
   • Everything else (docker0, lxcbr0, wolfnet0) — leave on their auto-detected zone; WolfRouter already knows.
3. Click ⚡ Quick Setup. The wizard will:
   • Preflight-install dnsmasq and iptables if missing.
   • Create a DHCP WAN connection on your WAN interface.
   • Create a LAN segment with 192.168.10.0/24 (editable), router IP 192.168.10.1, DHCP pool 192.168.10.100–250.
   • Pick your preferred DNS provider from the dropdown (Cloudflare by default).
   • Apply the firewall, then run a host-side DNS bind check.
4. Run setup. Watch the step-by-step ✓/✗ output in the wizard. About ten seconds on an already-installed box; a minute if dnsmasq still needs apt-installing.
5. Verify from a client. Plug a laptop into your home switch, let it get a lease. It should hit the internet immediately. If DNS fails, open the DNS Tools tab → LAN-side section → enable query logging → try nslookup cloudflare.com 192.168.10.1 from the client. Entries in the log = DNS path works; no entries = firewall/routing issue on the client side.

Which setup matches your situation?

The rack view

The flagship visual: your whole cluster rendered as a real server rack, with the Internet "cloud" at the top and patch cables routing from each WAN port up through the rack rails to the cloud. Each cluster node is a 2U appliance (or 3U/4U/5U if it hosts more than 6 devices) with a brand panel, hostname LCD, status LEDs, RJ45 jacks with link/activity indicators, and live BPS readouts on active ports.

• Per-node device columns — VMs (blue) and containers (purple) appear to the right of their owning server, wired in with curved patch cables. Hover a port to see Interface / State / Role / IP. Click to assign a zone.
• Manhattan-routed cables — right-angle bends (no spaghetti curves), colour-coded by purpose: yellow WAN, blue LAN, green WolfNet, purple management, grey unassigned.
• Animated when active — cables carrying live traffic flow with dashed animation; idle cables stay static. Activity LEDs above each port pulse on packet bursts.
• Inter-node WolfNet mesh — every pair of cluster nodes shows a green animated cable on the right side of the rack — the L3 overlay holding the cluster together is visible, not implied.
• Live, refreshes every 3 seconds — topology aggregates from each node's local snapshot via the cluster secret RPC. New nodes appear on the next poll.

Per-host WolfRouter

WolfRouter appears at two levels in the tree. At cluster level it shows the whole stack — the rack view, every node, every LAN. Inside each host node there is now also its own WolfRouter entry: opening it gives you that single host’s router exactly as if you had connected to the machine directly.

This matters when the router-shaped node isn’t the cluster master. Changing DHCP settings or reading DHCP leases on, say, an ISP-facing router node used to mean logging into that node’s own dashboard. The per-host view does it from one place — every firewall, LAN, lease, DNS and proxy action is proxied straight to that host, so edits land on the right machine.

Troubleshooting cheat sheet

Most problems fall into one of a handful of patterns. This table saves you ten minutes of staring at logs.

Glossary — in plain English

What it replaces

For the typical homelab use case — "I want a firewall, DHCP for my LAN, a way to forward ports, and visibility into what's flowing" — WolfRouter replaces:

• OPNsense or pfSense (running as a VM)
• Standalone dnsmasq or ISC DHCPD configs
• Manual iptables wrangling
• SSH-ing in to run tcpdump
• Hunting through Grafana for a network topology view

For deeper requirements (IDS/IPS via Suricata, captive portal, full BGP/OSPF, multi-WAN failover) you'll still want a dedicated firewall — OPNsense remains in the WolfStack app store for those use cases. But for 90% of homelab and small-business setups, WolfRouter is the firewall.

Available now

Ships as part of WolfStack v17.2.0+, with Quick Setup, DNS Tools, and config export/import added in v17.4.10+. Find it under Networking → WolfRouter for each cluster in your sidebar.

Install WolfStack Networking docs WolfNet overview