Frequently Asked Questions (FAQ)

RoamSwitch for Linux is a free, zero-trust autonomous network defense and security diagnostic suite for Linux built on strict Zero Telemetry (no external telemetry transmission). It provides sub-second nftables firewall profile switching, canary-based ransomware isolation, a 27-item comprehensive security audit, and read-only AI integration via MCP in a single lightweight binary.

While existing tools focus on passive file scanning or periodic manual audits, RoamSwitch specializes in active real-time automation: sub-second nftables rule switching based on Wi-Fi changes, automated network isolation upon threat detection, and seamless zero-click background protection.

The core binary is distributed as proprietary freeware (Community Edition, closed source). However, peripheral developer tools, client SDKs (Rust/Python), and MCP server definitions are released as open source on GitHub.

To ensure absolute transparency, Lafine publishes a comprehensive security whitepaper outlining step-by-step packet capture and system call verification methods. Users can independently confirm using tcpdump or eBPF tools that no information about you or your machine is ever sent outbound (the only outbound traffic by default is a daily update that only receives signed data).

It guarantees that zero security logs, system information, traffic history, or audit scores are ever sent to any remote server or cloud, including Lafine's own infrastructure. All analysis and policy enforcement execute 100% locally on your Linux machine.

RoamSwitch inspects the gateway MAC/BSSID of connected networks in milliseconds and automatically applies tailored nftables rulesets for Home (Trusted), Office (Balanced), or Public Wi-Fi (Lockdown) environments without requiring manual iptables/nftables configuration.

When tampering with a canary (decoy) file is detected, RoamSwitch cuts all external traffic (Air-Gap) and sharing services in an emergency to stop the damage from spreading across your LAN. When fanotify/inotify with Shannon entropy analysis detects a rapid encryption burst, it immediately freezes the offending process with SIGSTOP and notifies you, and likewise cuts all external traffic (Air-Gap) and sharing services in an emergency.

When an unapproved USB mass storage device is connected, udev integration holds mounting and presents a confirmation dialog (with optional ClamAV scanning). For BadUSB keystroke-injection devices, evdev (EVIOCGRAB) temporarily grabs keystrokes in software and displays an approval dialog to suppress unauthorized commands without physical port disconnection.

Upon connecting to an untrusted network, RoamSwitch automatically brings up your configured WireGuard (.conf) or Tailscale (Exit Node) tunnel. An nftables kill switch immediately blocks non-tunnel plaintext leaks, ensuring a strict fail-closed state even if the tunnel drops (opt-in).

RoamSwitch extracts outbound destination hostnames from local DNS queries, TLS SNI, and HTTP Host headers, comparing them against locally stored signed threat feeds and brand homograph heuristics to warn or block phishing connections (effective even with DoH browsers) without sending URLs to any cloud.

Ubuntu 22.04 / 24.04, Debian 12+, Linux Mint, Pop!_OS, Fedora, RHEL, CentOS Stream, openSUSE, Arch Linux, and Raspberry Pi OS (64-bit), covering all major distributions utilizing systemd and nftables.

You can install it via official package repositories: APT for Ubuntu/Debian (lafine.net/apt), DNF for Fedora/RHEL (lafine.net/rpm), zypper for openSUSE (lafine.net/rpm), and PKGBUILD / signed tarball for Arch Linux (lafine.net/linux/dl/).

Yes. While a native GTK GUI and tray icon are provided for desktop users, headless systems can operate fully via the background daemon, the 'roamswitch' CLI command suite, and the MCP server interface.

The Client Edition (this tab) is optimized for roaming devices — workstations and laptops that move between networks. For a cloud VPS or data-center server, use the dedicated headless roamswitch-server package instead (also free, distributed separately). It includes server-specific features such as inbound Default Drop, SSH lockout prevention, and eBPF intrusion detection. See the "🖧 Linux Server Edition" tab for details.

Yes — it has already shipped, and like the Client Edition it's free (Community Edition, every feature included, no activation required). Install it as the separate roamswitch-server package via APT / DNF / zypper / AUR.

Use “🧰 Recovery and uninstall” → “🗑 Uninstall RoamSwitch…” in the tray, the command sudo roamswitch uninstall, or a package manager such as apt remove (version 1.10.7 and later). On every route, RoamSwitch undoes every change it made to the network (firewall tables, the gateway ARP lock, DNS and so on) before removing anything, so the connection does not stay cut off. See the uninstall steps for the details.

It evaluates 27 critical parameters: Secure Boot, LUKS full disk encryption, LSM status (AppArmor/SELinux), automated security updates, SSH/Sudo hardening, sysctl kernel hardening, external listening ports, browser Safe Browsing, ARP pinning, and DNS threat protection, producing a standardized security score (0-100).

You can inspect live results via the GTK GUI dashboard or by executing 'roamswitch status' in any terminal for a comprehensive CLI report.

roamswitch-mcp is a standardized interface that allows AI agents such as ChatGPT, Claude, Cursor, and Antigravity to securely inspect your local Linux security posture without needing custom integration code.

You can ask your AI assistant questions like 'What is my current security posture score?' or 'Are there any dangerous exposed ports on this machine?' The AI reads local diagnostic data and generates clear remediation steps and audit summaries.

None. The bundled MCP server is architected as strictly read-only communicating exclusively over local stdio. Even under adversarial prompt injection, AI agents cannot alter firewall rules, modify system configuration files, or execute privileged commands.

A. It's probably not broken — RoamSwitch's BadUSB Keyboard Guard may be temporarily blocking keystrokes from a keyboard that isn't on the allowlist, and showing an approval dialog. Select “Allow” in that dialog to register the keyboard and restore input. If there's no response within 3 minutes, input is released automatically (so a headless machine never gets locked out). If you don't see the dialog, unplug and replug the keyboard to bring it back.

A. Yes — outbound traffic like web browsing and package updates is never restricted at any protection level. The three levels differ in how much unsolicited inbound traffic nftables allows. open is meant for a home LAN and allows local traffic. balanced is for work networks or tethering — it watches for suspicious ports without getting in the way of normal use. lockdown is for public Wi-Fi and drops all inbound traffic in stealth mode. None of the levels ever block traffic you initiate yourself (browsing, outbound SSH client connections, etc.).

Some of it, yes; some of it exists only on the Server Edition.

What works on the client
Inbound traffic is refused by default (the protection level follows the kind of network). On top of that there are port-scan detection and blocking, detection of unknown listening ports, security-log auditing, the ransomware decoys (canary), the credential decoys (honeytokens), tamper monitoring of critical files (FIM) and monitoring of autostart (persistence) entries. Notifications are desktop notifications and are kept in the history. On the Mac most of these are Pro features and turn on automatically when you enable Pro.

SSH brute force
Immediate blocking works only while Remote Login (sshd) is on (pf on the Mac, nftables on Linux). On a machine where sshd is not running, nothing is read and nothing is changed.

A lead from FIM
The notification about a tampered critical file carries a lead to an SSH login. On Linux it is tied to the SSH login the changing process belongs to. The Mac cannot do that, because macOS does not say which process wrote a file: it only lists the SSH logins that started around the change. That is a clue from overlapping times, not proof that the login made the change.

What exists only on the Server Edition
Detection by eBPF (when a sensor such as Falco is installed) is on the Linux client and not on the Mac. RoamSwitch's own reverse-shell detection exists only in the Server Edition.

A fully headless (zero GUI dependencies) autonomous defense suite for cloud VPS, on-premise data centers and container hosts. It ships as a separate package and binary, roamswitch-server, distinct from the Client Edition (roamswitch). It provides inbound Default Drop, SSH lockout prevention, eBPF intrusion detection, critical-path FIM (tamper monitoring), egress/C2 blocking and emergency alerts, all in one lightweight systemd daemon.

The Client Edition focuses on roaming: it detects changes in the Wi-Fi you're on (by gateway MAC) and autonomously switches between three firewall profiles. The Server Edition assumes no network roaming and instead defaults to an always-on inbound Default Drop, with SSH management-path protection, container port-exposure prevention, and kernel-level eBPF intrusion detection (Falco or Tetragon) — threats specific to an always-on server. There's no GUI or tray icon; you operate it via the CLI (the roamswitch command), config files, and MCP.

Like the Client Edition, the Community Edition is free with every feature included and no activation required. For organizations that want to centrally manage a fleet of servers, a paid RoamSwitch Business tier (fleet management, signed policy distribution, SLA support) is planned but not yet available. The endpoint defense itself is included in the free edition.

Yes. Traffic content, connection history, diagnostic results and the like are never sent anywhere, even by default. By default the only outbound communication is updates through your OS package manager (apt/dnf/zypper) and an anonymous receive of signed data (the kernel CVE data, the web rules and, on Ubuntu servers, the Ubuntu package CVE data used by the OS-package CVE check; an HTTPS GET to lafine.net; the signed manifest is checked daily and the CVE data itself about every 30 days; it contains no information about the host and can be turned off with roamswitch server config set cve_kernel_map_updates_enabled false). Notifications, event forwarding, npm signature verification and the like communicate only when the operator has explicitly opted in. The daemon contains no external-communication library, and this is verified at build time by an audit script (audit_no_network.sh). The full list of exceptions is published in the Zero Telemetry section of the Server Edition Security Whitepaper.

Ubuntu 22.04/24.04, Debian 12+, Fedora, RHEL, Rocky Linux, AlmaLinux, openSUSE, and Arch Linux (all require systemd + nftables). Both x86_64 and aarch64 (including AWS Graviton) are supported.

From the same official repositories as the Client Edition, just installing a different package name: sudo apt install roamswitch-server (Ubuntu/Debian), sudo dnf install roamswitch-server (Fedora/RHEL family), sudo zypper install roamswitch-server (openSUSE). It mutually Conflicts with the Client Edition package (roamswitch), so the two cannot be installed on the same host at the same time.

Run the interactive setup wizard with sudo roamswitch server setup. It walks you through the SSH management port, maintenance source IPs, emergency notification channels (Telegram/LINE/Webhook), and the action to take on a critical eBPF event (isolate/freeze/alert_only), then sends a test notification and restarts the service.

After editing /etc/roamswitch/server.conf, run sudo roamswitch server restart. The roamswitch-server.service unit does not support reloading its config via systemctl reload — only a full restart.

It's optional. Creating /etc/roamswitch/guard.yaml lets you specify a distinct containment action (notify-only / isolate the process / isolate the whole host) and a safety timer for each Falco/Tetragon severity level (warning/error/critical/emergency). If the file doesn't exist, an equivalent policy is automatically synthesized from server.conf's action_on_critical, so existing deployments are unaffected. A template ships at /etc/roamswitch/guard.yaml.example.

From the moment it's installed, every inbound connection is denied except the ports explicitly allowed in allowed_ports (default 80, 443). This prevents an unintentional management or debug port from being accidentally exposed to the internet.

There are several layers of protection: (1) existing ESTABLISHED/RELATED connection sessions are always preserved; (2) ssh_ports (default 22) is always allowed unconditionally; (3) even during an emergency host isolation (Air-Gap), preserve_ssh_on_isolation=true (default) keeps the administrator's SSH session alive; (4) an invalid config syntax or an nftables load failure automatically rolls back to the last-known-good rule set. Server Edition 1.10.4 and earlier had a defect. The isolation ruleset dropped the SSH replies, so the operator's SSH did not work during isolation. It was fixed in 1.10.5.

Yes. Docker's -p flag creates its own iptables rules by default, which can bypass the host's standard firewall and expose a container port directly to the internet. With protect_docker_ports=true (default), RoamSwitch inserts an inspection rule at the head of the DOCKER-USER chain so that traffic destined for containers is also subject to the allowed_ports / whitelist_ips policy.

Log in via your cloud provider's web console (VNC/serial console) and run sudo roamswitch emergency-restore to restore the firewall to its last-known-good baseline and clear any emergency isolation, or run sudo systemctl stop roamswitch-server to stop the service entirely.

It hooks into kernel-space eBPF sensors to detect reverse shells, privilege escalations, and container escapes in real time. The default sensor is Falco (JSONL over a UNIX domain socket), but setting sensor.type: tetragon in guard.yaml switches it to Cilium Tetragon (native gRPC, over the same UNIX socket). Neither adds a new listening port.

Depending on action_on_critical (or the policy in guard.yaml), one of isolate (network-isolate the offending process), freeze (SIGSTOP the process and network-isolate it), or alert_only (notify only) fires automatically. Setting kill_process: true also sends SIGKILL in addition to isolation. Foundational daemons — init, container runtimes, package managers, and more — are always excluded from freeze/kill via a protected-process list.

It's the grace period after an emergency host isolation (Air-Gap) fires, during which the administrator must acknowledge it with sudo roamswitch server ack (guard.yaml's safety_timer_secs, default 300 seconds). If no acknowledgment arrives in time, RoamSwitch automatically restores network access so a false positive can't leave the server cut off indefinitely.

It monitors SHA-256 hashes of 150+ critical binaries, authentication configs, and systemd units. Files are individually watched via fanotify (FAN_CLASS_NOTIF) write-completion events, so tampering is detected the instant it happens rather than waiting for the next periodic scan (which remains as a backstop). On a legitimate OS package update, the baseline is re-synced automatically via Debian/Ubuntu's DPkg::Post-Invoke hook or Fedora/RHEL/openSUSE's systemd.path unit, preventing false-positive alerts.

Decoy files placed under web roots (/var/www, /srv, etc.) whose integrity is checked periodically. If a decoy is tampered with or encrypted, RoamSwitch identifies the accessing process, freezes and isolates it, and sends an emergency notification.

Egress blocking (egress_ip_blocklist_enabled, default true; the bundled seed lists only the three attack servers JPCERT/CC published, and nothing else is blocked until a feed is populated) blocks outbound connections to known-malicious IPs via nftables. The DNS sinkhole (dns_sinkhole_enabled, default false to avoid breaking internal DNS or split-horizon setups) forces resolution through a filtering DNS resolver (Quad9/Cloudflare/AdGuard/CleanBrowsing) to also block malicious domain resolution.

Telegram Bot, the LINE Messaging API, and generic Webhooks (Slack / Discord / Microsoft Teams / your own monitoring stack). Alerts are dispatched instantly on major incidents — unauthorized port exposure, FIM tampering, eBPF threat detection, or an emergency isolation. Run roamswitch server test-notify to verify your configuration.

In most cases, the supergroup's chat ID is missing its required -100 prefix (e.g. -1001234567890). Check the correct value in the "chat":{"id":...} field of the response from curl -s "https://api.telegram.org/bot<token>/getUpdates".

Run it with roamswitch status --server. It audits 34 items aligned with the CIS Benchmark — firewall state, Frag Gap mitigation (disabling unprivileged user namespaces), Yama LSM memory protection, critical file permissions, Docker exposure, and more — producing a 0–100 security score and a letter grade (S to C).

No. The bundled roamswitch-mcp is designed to be strictly read-only (state-retrieval and audit tools only). Even if a web app's logs contained a malicious prompt injection, an AI agent could not open up the firewall or lift an isolation through it. Changing policy or releasing a frozen process always requires an explicit command run from a local TTY (an SSH terminal).

These are planned features and are not available today. The design envisions fleet management (enrolling multiple servers with an Ed25519-signed organization token and aggregating protection level, health score and policy status), signed policy distribution (pushing trusted networks and each guard's enforced values as signed JSON), a private APT/RPM repository signed with an organization-specific GPG key, and contract-based SLA support. No management server or fleet-management feature exists today. The endpoint defense itself is included in the free edition and is not to be reduced in Business.

Currently it targets standalone Docker/Podman hosts. Policy distribution and auditing across an entire Kubernetes cluster is being considered as a possible future extension of the Business fleet-management features. Send specific requests to our support contact.

Yes, but only within a range. Here is what it can detect, and where it stops.

What it detects, and then stops or reports
- SSH brute force: it reads sshd's log the moment a line is written and blocks a source whose failures reach the threshold (by default 6 within 600 seconds), in about 0.2 seconds as measured. It drops new connections and, at the same time, cuts the SSH connections that source already had open. An authenticated session and an exempt source are never cut.
- Activity after an intrusion: the eBPF runtime guard (Falco / Tetragon) detects reverse shells, privilege escalation and container escapes, and responds automatically, from isolating the process up to an Air-Gap of the whole host. RoamSwitch also looks for reverse shells to outside addresses by itself every 2 seconds (about 2.4 seconds after the connection, as measured). The time from detection to response is recorded; measured, it was 42 to 64 ms.
- File tampering: FIM detects a change to a critical file at once, and the notification names who made it (account, executable, command) and through which SSH login (source IP, time, authentication method). When that could not be checked, it says so.
- Also: contact with the ransomware canary and the decoy credentials, port-scan detection and blocking, DNS-tunneling detection, blocking of outbound traffic to known malicious IPs, and detection of connections to the cloud metadata address (notification only).

About notifications
They leave the server only when the operator has configured a destination (Telegram, LINE, a webhook or event forwarding). These are off by default, and the history is always recorded on the server itself.

Limits
- How accurate and how fast eBPF containment is depends on the rules of Falco or Tetragon. In fact, the 29 standard rules of Falco 0.45.0 include none that detects a reverse shell on the host. RoamSwitch makes up for this with a heartbeat that checks the alert path is alive and with its own reverse-shell detection, but that does not close every gap in the rules.
- FIM shows the fact of a change and the process and login behind it. It does not show the way in itself (such as the vulnerability that was exploited).
- The SSH blocking counts per source, so it is weak against a distributed brute force that tries once from many IPs. When fail2ban or CrowdSec (with an enabled sshd jail) is running, RoamSwitch yields the blocking and only detects and notifies.
- As the real fix, combine it with disabling password authentication (keys only) and restricting who can connect (an allowlist).