User-space only
No kernel modules, packet tampering, or privileged network hooks.
Open-source alpha · v0.4.6
Make bad traffic
take the long way.
A local deception layer for small HTTP services.
Net Ward sits in front of your app as a user-space reverse proxy. Clean requests reach the real service. Known probes and low-end abuse receive harmless mirror responses that waste automated effort—without a cloud contract, kernel hooks, or retaliation.
- User-space
- Fail-open design
- No retaliation
- No maintainer telemetry
A small service should not need a giant cloud contract to waste a bot’s time.
Deception, not retaliation
Mirrors return normal HTTP. No hostile payloads, malware, or counterattack behavior.
Fail-open posture
Classification, storage, or rendering failures are designed to pass traffic upstream.
Operator-owned data
Traffic records remain in the operator’s local SQLite database. Nothing is sent to the project.
Quick start
Put a local ward
in front of your app.
Install Net Ward, copy the example configuration, and point
upstream_target at the service you want to protect.
Install
$ pip install netward
Configure
$ cp example_config.json config.json
$ $EDITOR config.json
Run
$ python -m netward --config config.jsonWhat ships today
Practical controls for the traffic you actually see.
Net Ward combines safe defaults with operator control. Patterns are inspectable, collisions can be disabled, and the project ships the load tooling needed to test behavior before a real service depends on it.
Bundled probe patterns
Common scanners, admin probes, environment-file paths, and current appliance-targeting signals.
Operator patterns
Add local detection rules, validate them at insertion, and disable patterns that collide with real routes.
Rotating mirror shapes
Return plausible JSON, HTML, redirect, empty-result, or rate-limit responses without a fixed fingerprint.
Load visibility
Exercise latency, error rate, and process resource behavior before choosing an operating envelope.
Proof, not theater
Reviewed, patched, and public about the edges.
Net Ward’s pre-launch review found three critical issues before v0.4.1 and closed them before release. The current v0.4.6 line keeps the security policy, changelog, tests, and known limitations public instead of asking operators to trust a badge.
Current supported alpha line.
Python 3.10, 3.11, and 3.12.
Patched before public launch.
No project analytics or traffic upload.
Privacy boundary
Local does not mean invisible. It means operator-owned.
A live reverse proxy needs local evidence to classify abuse. Depending on configuration, the SQLite record may include source IPs, timestamps, paths, selected headers, query strings, request sizes, short body snippets, classifications, and alert metadata.
That data stays on the operator’s machine. Net Ward does not upload it, sell it, share it, or use it for project telemetry. Operators remain responsible for access controls, retention, and handling under their own privacy obligations.
Known limits · v0.4.x
Useful now.
Not pretending to be finished.
01 Static regex checks are best-effort; untrusted custom patterns still require review.
02 Reverse-proxy source awareness requires manual X-Forwarded-For handling.
03 Windows database ACL enforcement is documented but not automatic in v0.4.x.
04 Flood context is single-source; coordinated low-rate multi-source detection is future work.
05 Continuous heavy-load operators should monitor RSS and restart on their chosen threshold.
Operator and project support
Questions, security reports, and sponsorship—routed clearly.
Net Ward is open-source alpha software. The support page separates product questions, private vulnerability reporting, source inspection, and voluntary project sponsorship.
Questions operators ask first
Know the boundary before traffic depends on it.
Is Net Ward a WAF or complete DDoS service?
No. It is a small, local reverse-proxy deception layer for known probes and low-end abuse. It does not replace application security, an edge network, rate limiting, or a full WAF.
Does it attack scanners or bots back?
No. Mirror responses are ordinary, harmless HTTP. Net Ward does not exploit, infect, retaliate against, or damage a visitor.
What happens when classification fails?
The design goal is fail-open: classification, storage, and mirror-rendering failures pass the request upstream. An unreachable upstream receives a default mirror rather than exposing a raw proxy-error oracle.
Does Net Ward collect my traffic?
It stores operator-owned local records needed for detection. Nothing is sent to the maintainers. Review the privacy boundary above and configure retention for your environment.
Who should run it today?
Operators of small HTTP services who understand reverse proxies, can review alpha limitations, and want a local deflection layer they can inspect.
Start with the code