We’ve published the core of Authinator3 as open source under the ISC
license: gitlab.com/jowolf/authinator3.
Authinator is a web login gateway for firewalls. Authenticate over HTTPS,
click once, and your current IP address is granted passage through the
firewall — everyone else sees a wall. It replaces both permanently-open
management ports and brittle port-knocking schemes with something anyone can
operate from a phone: a login page.
Authinator has guarded our own production gateways in one form or another
since 2007. Authinator3 is the modernized cross-platform release: a single
self-contained Go binary per platform, driving OpenBSD pf tables (confined
by pledge/unveil, no sudo, no shell calls) or Linux nftables sets
(under a locked-down systemd service). Default-deny, explicit allow, with an
audit view of every address currently cleared through.