reventlabs/GFW ? reverse-engineered prompt

Build me a Linux app that works like a flexible internet firewall and traffic filter. I want it to watch network connections in real time, understand common protocols like HTTP, TLS, DNS, and SSH, and let me write simple rules to allow, block, drop, or modify traffic based on things like host names, SNI, or DNS queries.

It should support both IPv4 and IPv6, handle lots of connections at once, and work well on a router or server. I’d like a clear config file for things like worker count and queue sizes, plus a rules file that’s easy to edit without being a developer. Include support for blocking specific sites, basic DNS rewriting, and detection of proxy or tunneling traffic like Shadowsocks or Trojan.

If you need to look up current docs online while building it, go ahead. Make it runnable from the command line with a simple build and start flow, and keep it easy to extend later with more protocol analyzers.