GhostGate

GhostGate is a VMware-based virtual privacy router lab for learning Linux networking, DNS filtering, firewalling, traffic monitoring, Tor gateway mode, WireGuard VPN routing, and privacy engineering limits.

It simulates a Raspberry Pi-style privacy router completely inside virtual machines, without extra hardware.

GhostGate is not a commercial VPN replacement and does not guarantee anonymity. It is a learning project for understanding how these systems work.

Final Lab Status

The core GhostGate lab is complete and verified in VMware Workstation Pro.

Area	Status
Router VM	Working
Client VM	Working
VMware LAN segment	Working
Static client routing	Working
IP forwarding	Working
NAT	Working
dnsmasq resolver	Working
DNS logging	Working
IPv4 tracker blocking	Working
DNS leak blocking	Working
SSH to router from Windows	Working
CLI wrapper	Working
Baseline service	Working
Traffic monitoring	Working
Flask dashboard	Working
Tor transparent mode	Working
Lockdown mode	Working
WireGuard local server path	Prepared
WireGuard VPS path	Documented
Split tunneling	Designed and documented

Current Verified Topology

Ubuntu Client VM
10.10.10.2
    |
    | GhostGate-Lab LAN segment
    v
GhostGate Router VM
10.10.10.1 on ens37
192.168.219.134 on ens33
    |
    | VMware NAT
    v
Internet

Optional WireGuard path:

Client VM -> Router VM -> wg0 -> WireGuard Server VM or VPS -> Internet

Optional Tor path:

Client VM -> Router VM -> Tor transparent proxy -> Internet

Verified Lab Values

Component	Value
Virtualization	VMware Workstation Pro
Router VM	Ubuntu Server
Router user	ggserver
Router hostname	ghostgateserver
Router outside interface	ens33, VMware NAT, 192.168.219.134/24
Router inside interface	ens37, GhostGate LAN, 10.10.10.1/24
Client VM	Ubuntu Desktop
Client IP	10.10.10.2/24
Client gateway	10.10.10.1
Client DNS	10.10.10.1
Router SSH from Windows	ssh -p 2222 ggserver@127.0.0.1
WireGuard server VM	192.168.219.136/24
WireGuard server SSH from Windows	ssh -p 2223 ghostgate-wg-server@127.0.0.1

Features

• Linux virtual router using Ubuntu Server
• VMware LAN segment based isolated client network
• NAT internet sharing
• dnsmasq DNS resolver
• DNS query logging
• tracker/domain blocking
• direct DNS leak blocking
• persistent firewall baseline
• traffic monitoring with tcpdump, iftop, and vnstat
• Tor transparent proxy mode
• lockdown kill switch mode
• WireGuard VPN mode scripts and templates
• local WireGuard server VM guide
• VPS WireGuard guide
• Flask read-only dashboard
• ghostgate CLI
• final leak testing and demo guides

GhostGate CLI

Install scripts on the Router VM under /opt/ghostgate/scripts, then symlink:

sudo ln -sf /opt/ghostgate/scripts/ghostgate /usr/local/bin/ghostgate

Common commands:

ghostgate status
ghostgate baseline
ghostgate dns-logs
ghostgate monitor vnstat
ghostgate leak-test
ghostgate tor-on
ghostgate tor-off
ghostgate vpn-on
ghostgate vpn-off
ghostgate lockdown
ghostgate unlock
ghostgate wg-keygen

Dashboard

The dashboard runs on the Router VM and is viewed from the Client VM:

http://10.10.10.1:5000

It shows:

• interfaces and routes
• dnsmasq state
• DNS logs
• firewall and NAT rules
• Tor and WireGuard service status
• traffic counters
• leak test output

The dashboard is intentionally read-only. Mode changes are done through the CLI.

Main Documentation

• Final Project Status
• Final Demo Script
• Architecture
• Roadmap
• VMware Setup
• Ubuntu Server Install
• Static IP Setup
• IP Forwarding
• NAT Routing
• DNS Resolver
• DNS Logging
• Ad And Tracker Blocking
• IPv6 Leak Notes
• Persistent Firewall
• SSH Access
• Firewall
• Traffic Monitoring
• GhostGate CLI
• Dashboard
• Dashboard Service
• Baseline Service
• Tor Mode
• Kill Switch
• WireGuard Basics
• WireGuard Lab Server
• VPS WireGuard Server
• VPN Mode
• Split Tunneling
• Leak Testing
• Troubleshooting
• Learning Notes
• Ethical Use

Repository Structure

GhostGate/
├── README.md
├── LICENSE
├── SECURITY.md
├── CONTRIBUTING.md
├── configs/
│   ├── blocklist.conf.example
│   ├── dnsmasq.conf.example
│   ├── split-tunnel.conf.example
│   ├── torrc.example
│   ├── wg0-client.conf.example
│   ├── wg0-router-client.conf.example
│   └── wg0-server.conf.example
├── dashboard/
│   ├── app.py
│   ├── ghostgate-dashboard.service
│   ├── requirements.txt
│   ├── static/
│   └── templates/
├── docs/
├── screenshots/
└── scripts/
    ├── apply-baseline.sh
    ├── dns-logs.sh
    ├── enable-ip-forwarding.sh
    ├── enable-nat.sh
    ├── firewall-basic.sh
    ├── ghostgate
    ├── ghostgate-baseline.service
    ├── killswitch-off.sh
    ├── killswitch-on.sh
    ├── leak-test.sh
    ├── monitor-traffic.sh
    ├── tor-mode-off.sh
    ├── tor-mode-on.sh
    ├── vpn-mode-off.sh
    ├── vpn-mode-on.sh
    └── wireguard-keygen.sh

Privacy Reality

GhostGate reduces and demonstrates traceability, but it does not provide perfect privacy.

Privacy can still be affected by:

• browser fingerprinting
• cookies
• account logins
• malware
• timing correlation
• DNS leaks
• misconfiguration
• VPS provider logs
• Tor exit node behavior

The realistic goal is:

Reduce traceability.
Understand leaks.
Build safer systems.

Ethical Use

GhostGate is strictly for authorized learning and personal lab use.

Do not use it for illegal activity, unauthorized access, abuse, or hiding harmful behavior.

License

GhostGate is licensed under the MIT License.