xzcrpw / blackwall

What is blackwall?

Blackwall is an AI-native eBPF firewall that runs inside the Linux kernel to inspect packets at line rate, blocking threats via JA4 TLS fingerprinting, entropy analysis, and behavioral tracking. Instead of just dropping bad traffic, it redirects attackers into an active deception mesh—a tarpit honeypot powered by local LLMs like Ollama that simulates a compromised Ubuntu server with fake SSH, HTTP, MySQL, and DNS services. Built in Rust, it attaches to your network interface via XDP, pulls threat feeds, and captures PCAP forensics, all configurable via TOML.

Why is it gaining traction?

Its cyberpunk vibe—named after the Blackwall quickhack from Cyberpunk 2077—hooks devs into trying this blackwall cyberdeck for homelabs, blending eBPF speed with AI-native deception that wastes attackers' time while logging their moves. The distributed mesh lets multiple nodes share intel peer-to-peer, and pure Rust with zero unwraps means it's reliable without bloat. Stands out from nftables or Suricata by being kernel-native and LLM-driven for adaptive blocking.

Who should use this?

Linux sysadmins hardening production servers against scanners and botnets, security researchers testing deception tactics, or homelab tinkerers wanting a blackwall gateway beyond basic firewalls. Ideal for edge nodes like VPS or cyberpunk-inspired setups needing active defense without cloud dependency.

Verdict

Try it for research or low-stakes homelabs—86 stars and 1.0% credibility score signal early maturity, but solid docs, 123 tests, and multilingual READMEs make it approachable. Polish the tarpit config for prod; it's a clever solo Rust project worth watching.

(198 words)