Can I preview NetForge changes first?

Yes. Use NetworkAuto.ps1 -DryRun on Windows or network-auto.sh --dry-run on macOS/Linux. This site also shows a labeled SAMPLE receipt of the plan. It is not a live apply on your machine.

What platforms does NetForge support?

Windows 10/11, macOS 12+, and Linux. Separate open-source repos: netforge-windows, netforge-macos, and netforge-linux under Pitchfork-and-Torch on GitHub.

NetForge 2.1.0 The Dry Run

Name: NetForge
Author: Pitchfork-and-Torch

Why NetForge

Local-firstCore apply path works offline. Logs stay on your machine.
IdempotentSafe to re-run on logon and network connect with lock files.
Config-drivenReview defaults and profiles before you elevate.

Feature matrix

Capability	Windows	macOS	Linux
Prefer Ethernet metrics / order	Yes	Yes	Yes
Encrypted DNS preference	DoH	Plain DNS API	DoT (resolved)
Captive portal helper	Yes	Yes	Yes
VPN respect mode	Yes	Yes	Yes
Dry-run / what-if	Yes	Yes	Yes
Status JSON + HTML	Yes	Yes	Yes
Optional hardening flags	Yes	Yes	Yes

v2.1.0 named cut

The Dry Run

Preview first. The receipt below is a labeled SAMPLE of what -DryRun / --dry-run prints. It is not a live scan of this browser and it does not apply settings.

01 Inspect Run status. See adapters, DNS, and VPN tunnels before any plan.
02 Plan Dry-run prints [plan] lines. Nothing is written yet.
03 Review Read the receipt. VPN adapters stay skipped when RespectVpn is on.
04 Apply Only after you elevate. Install is a separate command.

SAMPLE plan only · nothing applied · not this host

[plan] SAMPLE receipt  -  nothing applied
[plan] Prefer Ethernet: raise Ethernet metric, lower Wi-Fi
[plan] Skip VPN / tunnel adapters (RespectVpn default)
[plan] DNS: resilient resolvers + encrypted DNS where the OS supports it
[plan] TCP: well-known stack profile
[plan] Captive portal helper: idle
[plan] Hardening flags: off unless config says so
[plan] Re-apply on logon / network connect: not installed yet

Windows:  .\src\NetworkAuto.ps1 -DryRun
macOS/Linux:  sudo ./src/network-auto.sh --dry-run

How to read the plan

Prefer Ethernet: Raise the wired interface metric (or service order on macOS) so Ethernet wins over Wi-Fi when both are up.
Skip VPN / tunnel: RespectVpn / RESPECT_VPN is on by default. Common VPN and tunnel adapters are left alone.
DNS: Resilient public resolvers, plus DoH on Windows and DoT on systemd-resolved Linux where the OS supports it.
TCP: A documented well-known stack profile. Not a speed-test and not a fake Mbps meter.
Captive portal: Idle until you run the helper. Hotel and airport portals need a temporary DNS relax, then restore.
Hardening: Off unless your config turns flags on. Aggressive options stay behind review.

Install (review first)

Windows (Admin PowerShell)

git clone https://github.com/Pitchfork-and-Torch/netforge-windows.git
cd netforge-windows
.\src\Get-NetForgeStatus.ps1
.\src\NetworkAuto.ps1 -DryRun
.\src\Install-NetworkAuto.ps1

macOS / Linux

git clone https://github.com/Pitchfork-and-Torch/netforge-macos.git   # or netforge-linux
cd netforge-macos
./src/netforge-status.sh
sudo ./src/network-auto.sh --dry-run
sudo ./src/install-network-auto.sh

Philosophy and non-goals

NetForge hardens your host network stack. It does not configure your router, fix ISP caps, or replace privacy routing tools.

No telemetry, accounts, or phone-home
No required internet for applying local settings
Aggressive options stay behind config flags

Composes with trench-coat (privacy routing) and ghost-continuum (defense plane).

FAQ

How does NetForge improve network performance?

It prefers Ethernet over Wi-Fi via interface metrics (or service order on macOS), applies well-known TCP stack settings, sets resilient public DNS with encrypted DNS where the OS supports it, and re-applies on logon and network connect so settings stick after sleep or network changes.

Is NetForge safe with VPNs?

Yes when RespectVpn / RESPECT_VPN is enabled (default in v2). NetForge skips common VPN and tunnel adapters so it does not fight split-tunnel or corporate VPN routing. Corporate profiles further reduce hardening side effects.

Does it collect data?

No. There is no telemetry, no account, and no cloud requirement for the core apply path. Logs and last-run files stay under local application data directories.

How do I handle captive portals?

Run the platform captive-portal helper to probe connectivity endpoints and temporarily relax DoH/DoT/static DNS so hotel or airport portals can load. After authentication, restore with the helper's restore flag or re-run the main apply script. Optional auto-restore is available on Windows.

Can I preview changes first?

Yes. Use NetworkAuto.ps1 -DryRun on Windows or network-auto.sh --dry-run on macOS/Linux. This page also shows a labeled SAMPLE receipt. It does not apply anything in the browser.