Case Study

Per-Device Egress Routing Appliance

Control VM/device traffic, proxy assignments, routing profiles and network operations from a web interface.

Status: Production

Production system — screenshots shown here use an isolated portfolio demo with fictional data. No production systems were accessed.

Product Development Web Applications Business Automation Custom Software Infrastructure / VoIP

Dashboard — Gateway health and fleet overview

Problem

Teams that need per-machine internet egress usually end up editing proxy and firewall configs by hand. That is slow, easy to break, and hard to audit when several machines need different upstream routes.

Solution

Built a self-hosted gateway product: operators add proxies, onboard machines or VPN peers, assign a route, and the appliance applies the networking change through generated configuration rather than manual server edits.

Key Features

• Proxy inventory with create, import, connectivity tests, and health checks
• Virtual-machine discovery and onboarding, including per-machine route assignment
• WireGuard peer management with config/QR onboarding
• Route failover when an upstream proxy becomes unhealthy
• System backup, configuration validation, reload, and rollback
• Monitoring, audit log, API tokens, and role-based panel access
• REST API for status, health, proxies, machines, routes, and gateway state

Technology

PHP Slim Twig Tailwind CSS MySQL Docker sing-box nftables WireGuard Tailscale Linux

Technical Architecture

The appliance runs on Debian. A Dockerized panel (web server, PHP application, MySQL) is the control plane. Host-level agents generate and apply sing-box and nftables configuration so each source is sent through its assigned upstream proxy or direct WAN. The same product supports a LAN-gateway mode for virtual machines and a remote WireGuard mode for peers. Proxy and VPN private material is stored encrypted. Panel access can be limited to a management network rather than exposing the control UI on the public internet.

Challenges

• Translating a simple operator action (“send this machine through that proxy”) into safe firewall and proxy-engine configuration.
• Supporting both local virtual-machine networks and remote VPN peers without creating two unrelated products.
• Validating generated configuration and rolling back if a reload would take the gateway offline.

Who This Is For

Operators who run virtual machines or remote peers and need controlled, per-source internet egress without hand-editing network configs.

Outcome

Built to replace hand-edited proxy and firewall configuration with a panel, health checks, and rollback. Business results are not currently documented.