Fix a specific problem
Why this exists
Most network trouble on a modern Linux desktop isn't a routing problem. It's a DNS problem that
looks like one. Your VPN pushed its own resolver, DHCP quietly overrode the one you configured,
systemd-resolved is answering from a per-link server you never chose, or a
kill-switch left an nftables table behind after its daemon died.
netmaster exists because a Wi-Fi link associated fine, the LAN worked, and the
internet was gone, and stayed gone across reboots. The cause was a stale VPN tun
device that NetworkManager had adopted and persisted, with hundreds of static routes.
probesource exists because "who is this address and why is it knocking" deserved a
better answer than four terminals of whois, dig and
tcpdump.
Quick start
git clone https://github.com/doug445/Panoptes.git
cd Panoptes
sudo ./install.shcheckdns # resolver, WARP, mDNS and ECH status in one readout
sudo audit-dns.sh # what controls DNS here, and where a leak could get in
netcheck # interfaces, Wi-Fi band/bitrate, firewall, whois
ech-browsers.sh # turn on Encrypted Client Hello in every browser you haveNothing installs a service or changes your system until you ask it to. audit-dns.sh
and netcheck are strictly read-only. The installer works out which of the suite's
~45 requirements are missing and installs them with dnf, apt, pacman, zypper or apk.
The tools
| Area | Tools | What they do |
|---|---|---|
| DNS | audit-dns.sh, harden-dns.sh, checkdns, dns-toggle, dns-tray | Read-only audit of everything that can set DNS. Idempotent DNSSEC and DNS-over-TLS hardening, with --dry-run. One-screen resolver status. A tray toggle between two encrypted resolvers, AdGuard and Cloudflare 1.1.1.2. |
| ECH | ech-build.sh, ech-browsers.sh | Builds an ECH-capable curl into its own prefix, which no distribution ships, and verifies it with a real --ech hard handshake. Enables ECH and the secure DNS it needs in every Firefox- and Chromium-family browser, native, Flatpak or Snap. Never touches Tor Browser or Mullvad Browser. |
| Watch | netwatch, nettop, netcheck, probesource | Desktop alerts for firewalld drops, new inbound connections and ARP anomalies. LAN and WAN hosts with vendors. A full interface and Wi-Fi readout. Investigation of any address, passive first. |
| Repair | netmaster, wifi-recover.sh, warp-setup.sh, warp-killswitch, warp-tray | The master network repair tool. Wi-Fi diagnosis, which changes nothing unless you pass --repair. Cloudflare WARP set up in tunnel-only mode, and a kill-switch that tears it down to nothing and restores it. |
probesource's passive tactics send nothing to the target. Its active tactics are for
hosts and networks you own or are authorised to test.
FAQ
Which Linux distributions does Panoptes support?
It is built and used daily on Fedora, and tested on Linux Mint, Manjaro, EndeavourOS, Debian/Ubuntu and Fedora Asahi Remix. Anything running systemd-resolved and NetworkManager is in scope, and its dependency installer understands dnf, apt, pacman, zypper and apk.
Will installing it change my system?
Nothing installs a service or changes your system until you ask it to. audit-dns.sh and netcheck are strictly read-only, harden-dns.sh supports --dry-run, and wifi-recover.sh diagnoses without changing anything unless you pass --repair.
Why does turning Cloudflare WARP off make my browser think it is offline?
DNS lookups in flight at that moment fail DNSSEC validation because their transport disappeared mid-chain, and systemd-resolved caches the failures. resolvectl flush-caches clears them. FallbackDNS= does not help: it is only used when DNS= is empty.
Does it touch Tor Browser or Mullvad Browser?
No. ech-browsers.sh never touches them: they resolve through their proxy circuit on purpose, and pointing them at a DoH resolver would send lookups around it.
On a Mac? The macOS counterpart is macOS-SecureNetwork-Suite.