SpamBlock counts attempts to establish a connection on port 25/tcp via tcpdump. When a host exceeds the allowed number of attempts per unit of time, it is added to a corresponding ipfw table and email notification is sent. Spamblock currently supports ipfw only, but it can be easily adapted for any firewall and OS. It can also be configured to watch multiple ports to prevent Telnet and SSH attacks in addition to SMTP.
The Dynamic Router Lite II project is a router project by the Dutch national police agency that allows Web-based client-control over the next-hop router for the client. A Dynamic Router Lite II system is placed as a default gateway between one or more client networks and a router network with multiple gateway-routers on it. The Dynamic Router Lite II system does policy-based routing with policy-based DNS to match the routing policy. By default a client will have no active gateway, and any attempted HTTP traffic to any domain will lead the user to the router's Web interface, where the user can then pick an appropriate next-hop router. Once picked, all traffic for the client including DNS will be forwarded to the next-hop router the user picked.
RCPlive is a router live CD based on Debian 7 and the RCP100 routing suite. It is a flexible firewalling and routing platform, configured using a command line interface syntax similar to the one found in commercial routers. The software runs directly from a read-only CD or USB stick, and provides persistence by saving the configuration into a file placed on an existing disk partition.