Neuron Shield

Neuron Shield a lightweight lightning fast DNS-based firewall redirects network DNS settings to a local server that matches queries in sub-milliseconds against over 200000 active threat intel rules.

Comment

Inspiration

Every day, our devices make thousands of background connections to trackers, telemetry endpoints, and suspicious links without our knowledge. Standard firewalls are bulky and slow down performance, while traditional browser adblockers only protect us within a single browser tab.

We took inspiration from two main sources:

  1. VPNs: They can intercept, inspect, and tunnel all network-level requests across an entire device, but they lack granular local control and often route your data to slow, centralized servers.
  2. Brave Browser: Brave's built-in shield blocks ads, trackers, and malicious requests locally, but its scope is limited to the browser window.

We wondered: Why not combine them? We wanted to create a unified, system-wide local shield that brings Brave-style ad and malware blocking to every single app on a device (browsers, background services, Spotify, terminal tools) without the overhead of a VPN. Thus, Neuron Shield was born.

What it does

Neuron Shield is a lightweight, local DNS-based firewall and encrypted proxy. It runs directly on your machine to intercept network traffic and filter out unwanted connections:

  • System-Wide Blocking: Blocks malicious phishing domains, ads, trackers, and telemetry across all installed software (not just web browsers).
  • Comprehensive Databases: Automatically downloads, parses, and loads standard Brave Shield, EasyList, EasyPrivacy, and malware-tracking list formats.
  • DNS-over-HTTPS (DoH): Encrypts outbound DNS requests, shielding your browsing history from ISPs and local network snoopers.
  • Intelligent Live Dashboard: Provides a beautiful, glassmorphic control center showing real-time WebSocket feeds of incoming queries, blocked categories, and custom filtering controls.

How we built it

We engineered Neuron Shield as a lightweight, performant, local stack:

  • Operating System Hooking: Wrote platform-specific scripts (bnfw.sh and bnfw.ps1) that reconfigure local network interfaces (using nmcli on Linux and netsh on Windows) to route DNS requests through localhost.
  • DNS Interceptor: Programmed a local UDP DNS server on Node.js using native UDP sockets to parse wire-protocol binary DNS query packets.
  • High-Performance Filter Engine: Designed a custom lookup engine (FilterEngine) utilizing memory-optimized HashMaps and hierarchical domain-walking algorithms to evaluate rules in sub-milliseconds.
  • Encrypted Resolver: Developed a DNS-over-HTTPS Client (DoHClient) to tunnel allowed queries securely via HTTPS POST requests to upstream secure resolvers (like Cloudflare or Google).
  • Modern Interface: Designed a glassmorphic web dashboard with real-time charts powered by Chart.js and live WebSockets.

Challenges we ran into

  • Performance & Scale: Parsing and loading over 200,000 rules was simple, but filtering queries through them in real-time was a major bottleneck. We overcame this by using hierarchical prefix mapping and indexing domain suffixes instead of running slow regular expression checks on every packet.
  • Cross-Device Compatibility: Ensuring the startup scripts could safely modify network interface bindings on different versions of Windows and Linux without disrupting general network stability.
  • Interference from Browser DNS Features: Fighting with modern browsers that try to bypass local system settings via internal Secure DNS flags. We solved this by implementing diagnostics to warn users when their browser is bypassing the firewall.

Accomplishments that we're proud of

  • Heuristic Classification Engine: We built an intelligent blocking classifier that automatically categorizes incoming blocklist rules into Malware, Phishing, or Trackers on-the-fly depending on pattern signatures.
  • Sub-Millisecond Resolution: Created a local DNS interceptor that handles rules database checks faster than the time it takes to ping an external server.
  • Cross-Platform Integration: Successfully automated local routing setup on both Windows and Linux through one-click setup files.

What we learned

  • Low-Level Networking: We gained deep knowledge about the DNS wire-protocol, building raw binary buffers, and UDP socket communications.
  • Operating System Hooks: Learned how different operating systems manage DNS settings (NetworkManager, systemd-resolved, Windows DNS client) and how to safely hook into them.
  • Optimized Data Structures: Learned how to design highly performant lookup indexes to search massive databases under tight microsecond constraints.

What's next for Neuron Shield...

  • Android Port: Creating an Android package that uses the Android VpnService API to tunnel DNS queries locally, bringing the same system-wide protection to mobile devices.
  • Browser Extension Helper: Developing a companion browser extension that coordinates with the local server to provide granular, tab-specific domain management.
  • On-Device Heuristic Classifier: Integrating a lightweight local machine learning classifier to analyze unknown, newly created domains on-the-fly, blocking zero-day phishing websites before they are even added to static blocklist databases.

Built With

Share this project:

Updates

Submission history