Demo Mode

easywall-web alone, backed by RAM instead of a privileged daemon. Every page works, every save is recorded, every apply runs the acceptance state machine. Nothing reaches a firewall.

Try it without installing anything. demo.easywall-project.org — one button takes you in, no account needed. Nothing there reaches a real firewall, and the state resets periodically.

Needs	one binary
Does not need	root, CAP_NET_ADMIN, nftables, easywall-core
State	in memory; gone on restart

Running your own

sudo mkdir -p /etc/easywall/ssl /var/lib/easywall

sudo tee /etc/easywall/web.toml > /dev/null <<'EOF'
bind_addr   = "0.0.0.0:12227"
ssl_dir     = "/etc/easywall/ssl"
data_dir    = "/var/lib/easywall"
session_key = "REPLACE_WITH_openssl_rand_hex_32"
demo_mode   = true
username    = "demo"
password    = ""      # empty: the wizard runs, and asks for the setup token below
[tls]
cert = ""
key  = ""
EOF

sudo easywall-web -config /etc/easywall/web.toml

The startup log confirms it, and — while no account exists — carries the setup token the wizard asks for. Without it nobody can finish the first run, you included:

demo mode active — using in-memory mock instead of core socket
{"time":"…","level":"WARN","msg":"first run: enter this setup token at /firstrun to create the account","token":"ABCD EFGH …"}

Finish the wizard yourself. Visitors never need the account: the login card of a demo is a single Enter the demo button. A public demo that leaves the first run to its first visitor is what the token exists to prevent.

Custom-rule syntax cannot be checked. There is no nft binary, so the page says live validation is not running rather than reporting a verdict it has no basis for. It used to answer “no errors” whatever was typed — a false green on the one page where being wrong locks you out. Address-list validation runs in the web process and works normally.

What visitors see

• A neutral Demo chip in the topbar of every page: nothing reaches a real firewall; state resets periodically
• A login card with one Enter the demo button and no password form

The button is a session without a password. That is the one thing demo mode relaxes: nothing behind it reaches a firewall, and every page that would write a credential refuses in demo mode. CSRF protection, the CSP and the rest stay as they are. The route does not exist on an installation — without demo_mode there is no way in but the password. With no privileged process running, the worst case is confined to the unprivileged web process and its data directory.

Resetting it on a schedule

Restarting the process wipes the state. A timer is enough:

# /etc/systemd/system/easywall-web-reset.timer
[Timer]
OnCalendar=hourly
Persistent=true
[Install]
WantedBy=timers.target

# /etc/systemd/system/easywall-web-reset.service
[Service]
Type=oneshot
ExecStart=/bin/systemctl restart easywall-web.service

When it does not work

Symptom	Cause
“Core daemon unreachable”	demo_mode = true is missing, or the binary predates it. Check the startup log
State vanished	By design — it is in memory. For persistence you want a real install
Login refused after a few tries	The rate limiter is real here too: 5 attempts per 10 minutes. Restarting the process resets it