OSI-licensed open source
A web security gateway sits between users and the internet, or between the internet and your applications, to filter traffic, enforce policy and block threats. There are two directions: secure web gateways filter outbound browsing with proxy, content filtering and malware checks, while reverse-proxy gateways and web application firewalls protect inbound traffic to your sites.
This page covers both directions with eight open-source options verified on their repositories on 2026-11-07: forward proxy and filtering (Squid, E2Guardian, OPNsense, pfSense CE) and inbound web application firewalls (Coraza, ModSecurity, BunkerWeb, SafeLine). Open source rarely matches a commercial cloud SWG feature for feature, so expect to assemble components.
Tools, licences and pricing checked against vendor and repository pages on November 7, 2026.
| Tool | Best for | Pricing | Licence |
|---|---|---|---|
| Squid | Forward proxy and caching with access control | Free, open source | GPL-2.0 |
| E2Guardian | Content filtering for schools and small networks | Free, open source | GPL-2.0 |
| OPNsense | Firewall distribution with proxy and filtering plugins | Free, open source; paid business edition and support, see vendor pricing | BSD-2-Clause |
| pfSense CE | Firewall distribution with Squid-based filtering packages | Free Community Edition; paid pfSense Plus from Netgate, see vendor pricing | Apache-2.0 |
| Coraza | Embeddable WAF for Go, proxies and ingress | Free, open source | Apache-2.0 |
| ModSecurity | Classic WAF engine with the OWASP Core Rule Set | Free, open source | Apache-2.0 |
| BunkerWeb | All-in-one reverse proxy WAF with a UI | Free, open source; paid PRO offering, see vendor pricing | AGPL-3.0 |
| SafeLine | Self-hosted WAF with a management console | Free, open source community edition; see vendor pricing for paid options | GPL-3.0 |
Best for: Forward proxy and caching with access control · Free, open source
Squid is a widely used caching and forwarding web proxy that supports access control and is the base of many open-source web filtering deployments.
Best for: Content filtering for schools and small networks · Free, open source
E2Guardian is an open-source web content filter that works with a proxy such as Squid to filter web traffic by content and category. Its stable 5.5 line is in bug-fix mode only.
Best for: Firewall distribution with proxy and filtering plugins · Free, open source; paid business edition and support, see vendor pricing
OPNsense is an open-source firewall and routing platform with a web GUI whose plugin system supports proxy and filtering functions.
Best for: Firewall distribution with Squid-based filtering packages · Free Community Edition; paid pfSense Plus from Netgate, see vendor pricing
pfSense is a free network firewall distribution based on FreeBSD whose package system adds functionality such as proxy and filtering.
Best for: Embeddable WAF for Go, proxies and ingress · Free, open source
Coraza is an open-source, high-performance web application firewall written in Go that supports ModSecurity SecLang rulesets and is fully compatible with the OWASP Core Rule Set v4.
Best for: Classic WAF engine with the OWASP Core Rule Set · Free, open source
ModSecurity (libmodsecurity) loads and interprets rules in the SecRules format and applies them to HTTP traffic through connectors for web servers.
Best for: All-in-one reverse proxy WAF with a UI · Free, open source; paid PRO offering, see vendor pricing
BunkerWeb is a next-generation open-source web application firewall built on NGINX that secures web services by default, with a web UI and plugins.
Best for: Self-hosted WAF with a management console · Free, open source community edition; see vendor pricing for paid options
SafeLine is a self-hosted web application firewall that protects web apps from attacks and exploits.
One email a week with the tools, launches and releases added to TechLogHub. Unsubscribe in one click.
One email a week: new and trending developer tools, fresh comparisons, and what shipped. Unsubscribe in one click.
| If you need… | Start with |
|---|---|
| Outbound proxy and caching | Squid |
| Category-based web filtering | E2Guardian |
| Firewall plus proxy in one appliance | OPNsense, pfSense CE |
| Embed a WAF in your stack | Coraza, ModSecurity |
| Turnkey WAF with UI | BunkerWeb, SafeLine |
Quick answers to common questions
A system that filters web traffic to enforce policy and block threats, either for outbound user browsing or inbound traffic to web applications.
Not as one product. Teams combine Squid with a filter such as E2Guardian or run it inside OPNsense or pfSense.
Yes. Coraza, ModSecurity, BunkerWeb and SafeLine protect inbound web applications and are included for the reverse-proxy side of the gateway role.
Yes, libmodsecurity is Apache-2.0 and its rules are compatible with Coraza and the OWASP Core Rule Set.
List it on TechLogHub and we'll review it for this guide.
