Landscape is an open-source router platform that configures a standard Linux distribution as a router by steering traffic by domain rather than IP alone, built in Rust with eBPF and aimed at self-hosters who want policy routing on hardware and distributions they already control.

What it is

Landscape is a routing stack that turns a general-purpose Linux machine into a policy router. It splits the work into two planes. The DNS plane runs in userspace: a flow is a policy group that devices join by IP address or MAC address, and each flow gets its own isolated Hickory DNS server with an independent cache, its own upstream (UDP, DoH, DoT or DoQ) and its own rules. The data plane runs in the kernel: XDP and TC hooks read per-flow eBPF maps and steer packets at wire speed, so matching traffic follows the flow's policy while everything else passes straight through.

The concrete problem it solves is that on Linux, steering traffic by domain usually means stacking DNS interception, marking rules and iptables or nftables chains, then reconciling them whenever a DNS answer changes. Landscape replaces that arrangement with a single loop: DNS results populate eBPF flow maps, and the kernel enforces steering with no userspace datapath and no iptables. It lives in the Linux networking ecosystem and targets the home-router and homelab niche, where the alternative is hand-assembled nftables and dnsmasq configuration.

Key capabilities

• DNS-driven traffic steering via eBPF, where DNS answers populate per-flow kernel maps consumed at XDP and TC hooks.
• Per-flow DNS isolation, giving each flow an independent cache, upstream and rule set with no cross-flow leaks.
• Fine-grained NAT: a stricter-than-symmetric policy by default, with per-domain and per-IP full-cone NAT exceptions.
• Packet redirection into Docker containers for flows that match, extensible with any TProxy-compatible program.
• Geo database management with support for the DAT and TXT formats.
• A full REST API, so everything exposed in the web UI is scriptable, documented at /api/docs.
• Single-directory upgrades and downgrades, where a new binary is dropped in and configuration auto-migrates.

Who uses it and how

• Homelab and small-network operators running Debian, Arch or openSUSE who want their existing distribution to act as the router rather than flashing dedicated firmware.
• Networks that need full-cone NAT for BitTorrent and private-tracker traffic on specific domains or addresses while keeping strict NAT everywhere else.
• Operators routing selected flows into Docker-hosted transparent proxies, where per-flow policies mean one container failing affects only the traffic routed through it.
• Administrators who prefer to drive configuration from scripts and automation against the REST API instead of clicking through the UI.
• Hosts running Linux kernel 6.9 or newer with BTF and BPF enabled, with the web server started under root as a systemd service.

Getting started

Download the landscape-webserver binary for your architecture and the separately released static.zip from GitHub Releases, extract the frontend assets to /root/.landscape-router/static, and run ./landscape-webserver as root; it starts without a pre-created configuration file and can be initialised through landscape_init.toml if preferred. The management interface listens on HTTPS port 6443 at https://landscape.local:6443, with documentation at https://landscape.whileaway.dev/.

How it compares

No comparable projects or paid products are named in the material available for this registry entry, so Landscape stands alone here among the infrastructure and networking tools catalogued. Readers evaluating it should treat it as a distinct option rather than a drop-in substitute for another listed tool.

When to use it — and when not to

Choose Landscape when a Linux host with kernel 6.9 or newer, BTF and BPF enabled, and root privileges is available, and when domain-level steering with per-flow DNS isolation is worth operating yourself. Do not choose it on non-Linux kernels such as FreeBSD or macOS, which are explicitly unsupported, or if running the router process as root is unacceptable. Two practical frictions are worth noting: the backend binary and the frontend static.zip are released separately, so upgrades require fetching both, and the default credentials of root / root must be changed immediately after first start.

mkdir -p /root/.landscape-router

./landscape-webserver

[Unit]
Description=Landscape Router

[Service]
ExecStart=/root/landscape-webserver
Restart=always
User=root
LimitMEMLOCK=infinity

[Install]
WantedBy=multi-user.target