Feature maturity
AiFw is in active development (beta). This matrix is the honest, per-feature answer to “does it work?” — a feature is not called supported just because its API, schema, or UI exists. Columns:
- Control plane — config model, API, UI, persistence implemented.
- Data plane — the FreeBSD kernel/service actually enforces it.
- Auto test — automated FreeBSD functional test exercises live traffic (the CI epic tracking this is #533; most rows are ⏳ until it lands).
- Validated — performance / multi-node validation with published, reproducible results.
✓ done · ⏳ not yet · ✗ not implemented
| Feature | Control plane | Data plane | Auto test | Validated | Status |
|---|---|---|---|---|---|
| Stateful filtering (pf) | ✓ | ✓ | ⏳ | ⏳ | Beta — daily-driven on real appliances |
| Rule scheduling | ✓ | ✓ | ⏳ | ⏳ | Enforced since v5.99.7 (windows compiled into pf, minute-tick reload) |
| Rule policy routing (route-to) | ✓ | ✓ | ⏳ | ⏳ | Since v5.100.0 |
| SNAT / DNAT / masquerade / 1:1 | ✓ | ✓ | ⏳ | ⏳ | Beta |
| NAT64 / NAT46 | ✓ | ✗ | ✗ | ✗ | In development — current rules do not perform cross-family translation ([#531](https://github.com/ZerosAndOnesLLC/AiFw/issues/531)) |
| WireGuard | ✓ | ✓ | ⏳ | ⏳ | Beta |
| IPsec | ✓ | ✗ | ✗ | ✗ | In development — SA records and firewall ports only; no kernel SAs or IKE yet ([#530](https://github.com/ZerosAndOnesLLC/AiFw/issues/530)) |
| OAuth / SSO login | ✓ | ✗ | ✗ | ✗ | In development — provider config + authorize flow exist; token exchange not implemented ([#170](https://github.com/ZerosAndOnesLLC/AiFw/issues/170)) |
| IDS (Suricata/Sigma/YARA subsets) | ✓ | ✓ | ⏳ | ⏳ | Beta — rule-language subsets, not full engine parity |
| IPS — reactive source blocking | ✓ | ✓ | ⏳ | ⏳ | Blocks the source after detection; the triggering packet is not stopped |
| IPS — inline prevention | ✗ | ✗ | ✗ | ✗ | Planned — divert/netmap roadmap |
| Traffic shaping — CoDel | ✓ | ✗ | ✗ | ✗ | In development — real dummynet FQ-CoDel backend tracked in [#532](https://github.com/ZerosAndOnesLLC/AiFw/issues/532) |
| Geo-IP filtering | ✓ | ✓ | ⏳ | ⏳ | Beta |
| Multi-WAN (FIB, gateways, policies) | ✓ | ✓ | ⏳ | ⏳ | Beta — latency thresholds + dampening enforced since v5.100.0; needs environment-specific validation |
| HA (CARP / pfsync / replication) | ✓ | ✓ | ✗ | ✗ | Beta — automated two-node failover validation tracked in [#534](https://github.com/ZerosAndOnesLLC/AiFw/issues/534); quantitative claims are design targets until then |
| Backup / restore / OPNsense import | ✓ | ✓ | ⏳ | ⏳ | Beta — snapshot + strict apply with automatic rollback (since v5.99.7); not a single DB+kernel transaction |
| DHCP / DNS / NTP (companions) | ✓ | ✓ | ⏳ | ⏳ | Beta — builds pinned to reviewed revisions since v5.99.8 |
| Reverse proxy + ACME (TrafficCop) | ✓ | ✓ | ⏳ | ⏳ | Beta |
| AI/ML threat detection | ✓ | ⏳ | ✗ | ✗ | Experimental, opt-in, disabled by default |
| Plugin system | ✓ | ⏳ | ✗ | ✗ | Beta — WASM planned |
Rows marked ⏳ under Auto test work on real appliances today but are verified by unit/integration tests against a mock pf backend, not yet by automated live-traffic tests on FreeBSD. Closing that gap is the project’s current top engineering priority (#533).
Documentation on this site is kept in sync with this matrix — if a page and this table disagree, file an issue.