Maze Linux / Wiki

Maze Guard

Maze Guard is Maze Linux's public Wi-Fi security monitor — a PyQt6 desktop app backed by the maze-guardd system daemon. It watches the network you are connected to and tells you when something on it is attacking you.

Not the same as OpenSnitch. Maze Guard watches the network around you. OpenSnitch watches what your own applications send out. Both ship with Maze; see Security for OpenSnitch.

---

What it detects

• MITM (man-in-the-middle) attempts — the classic coffee-shop attack where someone puts themselves between you and the router.
• ARP spoofing — the usual mechanism behind MITM on a local network.
• Rogue gateways — a device claiming to be the router when it is not.
• Suspicious traffic patterns on the local segment.

It integrates with firewalld, so detections can translate into firewall action rather than just a notification.

---

Running it

Maze Guard's GUI autostarts on the desktop and lives in the system tray.

systemctl status maze-guardd    # the daemon
maze-guardctl                   # command-line control

---

When it matters most

Maze Guard is aimed squarely at untrusted networks: airports, hotels, cafés, conferences, campus Wi-Fi. On your own home network it will usually stay quiet.

That is the point — it is the layer that assumes the network is hostile, which none of the other layers in Maze do.

---

Limits

Maze Guard watches the network, not your processes. Malware already running on your machine is a different problem — see Known Limitations for what each layer does and does not cover.

---

Related

• Security Reference
• Privacy Reference
• Known Limitations