Feature maturity
AiFw is in active development (beta). This matrix is the honest, per-feature answer to “does it work?” — a feature is not called supported just because its API, schema, or UI exists. Columns:
- Control plane — config model, API, UI, persistence implemented.
- Data plane — the FreeBSD kernel/service actually enforces it.
- Auto test — automated FreeBSD functional test exercises live traffic (the CI epic tracking this is #533; most rows are ⏳ until it lands).
- Validated — performance / multi-node validation with published, reproducible results.
✓ done · ⏳ not yet · ✗ not implemented
| Feature | Control plane | Data plane | Auto test | Validated | Status |
|---|---|---|---|---|---|
| Stateful filtering (pf) | ✓ | ✓ | ⏳ | ⏳ | Beta — daily-driven on real appliances |
| Rule scheduling | ✓ | ✓ | ⏳ | ⏳ | Enforced since v5.99.7 (windows compiled into pf, minute-tick reload) |
| Rule policy routing (route-to) | ✓ | ✓ | ⏳ | ⏳ | Since v5.100.0 |
| SNAT / DNAT / masquerade / 1:1 | ✓ | ✓ | ⏳ | ⏳ | Beta |
| NAT64 / NAT46 | ✓ | ✓ | ✓ | ✓ | pf af-to translation (FreeBSD 15+); TCP/UDP/ICMP live-traffic tested in CI ([#531](https://github.com/ZerosAndOnesLLC/AiFw/issues/531)) |
| WireGuard | ✓ | ✓ | ⏳ | ⏳ | Beta |
| IPsec | ✓ | ✓ | ✓ | ✓ | IKEv2 site-to-site (tunnel mode, PSK/X.509, NAT-T) via strongSwan; verified two-endpoint on FreeBSD incl. rekey, DPD, and reboot recovery ([#530](https://github.com/ZerosAndOnesLLC/AiFw/issues/530)). No IKEv1/AH/transport/mobile-EAP. |
| OAuth / SSO login | ✓ | ✗ | ✗ | ✗ | In development — provider config + authorize flow exist; token exchange not implemented ([#170](https://github.com/ZerosAndOnesLLC/AiFw/issues/170)) |
| IDS (Suricata/Sigma/YARA subsets) | ✓ | ✓ | ⏳ | ⏳ | Beta — rule-language subsets, not full engine parity |
| IPS — reactive source blocking | ✓ | ✓ | ⏳ | ⏳ | Blocks the source after detection; the triggering packet is not stopped |
| IPS — inline prevention | ✗ | ✗ | ✗ | ✗ | Planned — divert/netmap roadmap |
| Traffic shaping — CoDel | ✓ | ✗ | ✗ | ✗ | In development — real dummynet FQ-CoDel backend tracked in [#532](https://github.com/ZerosAndOnesLLC/AiFw/issues/532) |
| Geo-IP filtering | ✓ | ✓ | ⏳ | ⏳ | Beta |
| Multi-WAN (FIB, gateways, policies) | ✓ | ✓ | ⏳ | ⏳ | Beta — latency thresholds + dampening enforced since v5.100.0; needs environment-specific validation |
| HA (CARP / pfsync / replication) | ✓ | ✓ | ✗ | ✗ | Beta — automated two-node failover validation tracked in [#534](https://github.com/ZerosAndOnesLLC/AiFw/issues/534); quantitative claims are design targets until then |
| Backup / restore / OPNsense import | ✓ | ✓ | ⏳ | ⏳ | Beta — pre-validated apply, single DB transaction, post-apply pf verification, snapshot rollback for kernel state (since v5.99.7; hardened for #535); kernel applies are still not transactional |
| DHCP / DNS / NTP (companions) | ✓ | ✓ | ⏳ | ⏳ | Beta — builds pinned to reviewed revisions since v5.99.8 |
| Reverse proxy + ACME (TrafficCop) | ✓ | ✓ | ⏳ | ⏳ | Beta |
| AI-assisted alert triage (LLM) | ✓ | ✓ | ⏳ | ✗ | Off unless a provider is configured |
| Behavioural ML threat detection | ⏳ | ✗ | ✗ | ✗ | Prototype crate only — not wired into daemon/API (#171) |
| Plugin system | ✓ | ⏳ | ✗ | ✗ | Beta — native in-tree plugins |
Rows marked ⏳ under Auto test work on real appliances today but are verified by unit/integration tests against a mock pf backend, not yet by automated live-traffic tests on FreeBSD. Closing that gap is the project’s current top engineering priority (#533).
Documentation on this site is kept in sync with this matrix — if a page and this table disagree, file an issue.