Stateful packet filtering
Rules on zones, addresses, ports and protocols. Connection tracking matches return traffic to the flow that started it.
Security Rules → Packet FilterCyphorn NGFW puts a stateful firewall, inline intrusion prevention, dynamic routing, VPN and multi-WAN into one appliance, and gives you a single browser console to run all of it.
Pick a capability to see what the appliance does with your traffic. Drag the scene to look around it.
Interfaces are grouped into zones, so rules describe intent: what the internet may reach in the DMZ, what the DMZ may reach on the LAN. Anything a rule does not allow stops at the zone boundary.
The IPS engine sits inline. It reassembles the stream, decodes the application protocol, and matches it against signature rules. A match drops the packet before it reaches your LAN, and files are pulled out of the stream and hashed.
OSPF keeps every router in the area in agreement about the topology. When a link fails, traffic moves to the next best path without anyone touching a config. BGP exchanges routes with your provider or a partner network.
Connect branch offices and remote staff through authenticated, encrypted tunnels. Traffic is readable on each site and unreadable everywhere in between.
Load balancing spreads outbound traffic across two gateways by weight, so a second line or a 4G modem adds capacity every day instead of sitting idle.
The appliance discovers connected devices, pings them on a schedule, and draws the topology. When something is slow, trace the path hop by hop or capture packets on any interface without leaving the browser.
Each feature below ships on the appliance and is managed from the same web console. The small print under each card tells you where to find it.
Click a module to filter the list. Drag to turn the ring.
Rules on zones, addresses, ports and protocols. Connection tracking matches return traffic to the flow that started it.
Security Rules → Packet FilterSource NAT, destination NAT and internal forwards publish a service without exposing the network behind it.
Security Rules → NAT / Port ForwardGroup interfaces into trust zones and addresses into pools, then write policy between them instead of between IPs.
Routing & Zones → Zone AssignmentNamed lists you reference from any rule. Edit the list once and every rule that uses it follows.
Security Rules → IP / Object ListsCap bandwidth or packet rate per rule, so one busy host cannot take the whole link.
Security Rules → Rate LimitsEvery tracked connection with its source, destination, protocol, state and counters.
Monitoring → ConnectionsThe engine sits in the traffic path as a transparent bridge and drops matching packets before they reach the LAN, not after an alert.
Integrations → IPS / IDS EngineWrite your own signatures alongside the managed rule set. Managed rules and your local rules are stored apart, so an update never removes your work.
IPS → Create Local Custom SignatureHTTP URI, host, method, user agent, headers and body. TLS SNI and certificate subject, issuer and expiry. DNS queries. Active and passive FTP.
IPS → Signatures ViewerFiles carried over HTTP and FTP are reassembled, typed by their magic bytes, hashed with MD5, SHA-1, SHA-256 and SHA3-384, and checked against known-bad hashes.
IPS → File Threat IntelligenceBlock or allow by country and by domain name, with policies scoped to specific clients.
IPS → Country GeoIP Policy · Domain MappingUpdates are checked against SHA-256, validated in a sandbox and installed atomically, with automatic rollback if a reload fails. New rules take effect without an interface reset.
IPS → SettingsSYN cookies keep the appliance answering legitimate clients while a SYN flood is under way.
Firewall & Policy → IDS / Security EngineReverse-path filtering drops packets that arrive on an interface they could not have come from. Martian packets are logged.
IDS / Security Engine → ProtectionRefuse ICMP redirects on IPv4 and IPv6, closing a classic way to divert traffic through an attacker.
IDS / Security Engine → ProtectionBind IP addresses to MAC addresses and pin static ARP entries, so a device cannot answer for someone else's address.
IDS / Security Engine → ARP InspectionAdd, list and remove routes with gateways and metrics from a single table.
Routing & Zones → Static RoutesAreas, stub and NSSA, MD5 or simple authentication, cost and timers per interface, redistribution of connected and static routes, and live neighbor, LSA and topology views.
Routing & Zones → OSPF RoutingeBGP and iBGP for IPv4 and IPv6 unicast. Route maps, maximum prefixes, eBGP multihop, TTL security, graceful restart, BFD and multipath, with a live peering table.
Routing & Zones → BGP Routing802.1Q VLANs, bridges and several addresses per interface, each switched on or off from the console.
Network → InterfacesCombine two ports into one bonded link for more capacity or a standby path.
Interfaces → BondingSet the APN, PIN and route metric for a cellular modem, and send or read SMS from the console.
Interfaces → 4G ConnectionJoin wireless networks from the console, with Wi-Fi events kept in their own log.
System Logs → Wi-Fi LogsAddress scopes, static leases, client options and the live lease list, with one-click lease removal.
Services → DHCP ServerResolver settings with a full DNS query log, plus the ARP table with static entries.
Network → DNS Settings · ARP TableSpread outbound traffic across two gateways by weight, so both uplinks carry traffic every day.
Integrations → Load BalancingCreate and edit WireGuard configurations and peers, with endpoints, keys and addresses in one place.
Integrations → WireGuard VPNRemote access for staff over WireGuard, with the live interface and peer status on screen.
Integrations → Cyphorn AccessA point-to-point encrypted tunnel with a pinned peer public key, idle probes and automatic reconnect with backoff.
Integrations → Cyphorn TunnelSystem health, interface throughput, IPS alerts and routing telemetry on live-updating panels.
Monitoring → DashboardCapture on any interface, filtered by protocol, IP version, direction and TCP flags. Captures are stored on the appliance for download.
Integrations → Packet CaptureProbe with ICMP, TCP SYN or UDP from a chosen interface. See RTT, jitter and loss per hop, drawn as a route tree.
Integrations → Latency AnalyzerDiscovers connected devices by ARP and ping sweep, pings them on a schedule, and exports to CSV, PNG or JSON.
Integrations → WAN LinksGeneral, DNS and Wi-Fi logs with acknowledgement, and IPS alerts exported as fast log or EVE JSON for your SIEM.
Monitoring → System LogsPer-device block windows on chosen weekdays, plus data quotas that block a device once it reaches its allowance.
Integrations → Parental ControlShare attached storage over SMB, with guest and read-only options and connection instructions for each platform.
Services → NAS & StorageRead-only operators can see everything and change nothing. Passwords are stored with bcrypt, and repeated failed logins lock the account.
System → User AccountsEvery administrative action is recorded in a dedicated audit log you can review from the console.
System Logs → Admin Audit TrailDownload the full configuration as an archive, optionally sealed with a passphrase, and restore it on the same or a replacement unit.
System → Backup & RestoreFirmware updates, NTP servers, time zone, hostname and service ports, all from the settings page.
System → Settings · Firmware UpdatesPress Ctrl K anywhere in the console and type to jump to any page.
Anywhere → Ctrl KConnect your internet line to the WAN port and your switch to a LAN port. Add a second line or a 4G modem if you have one.
Sign in to the web console, assign interfaces to zones, and write the rules between them. DHCP and DNS are on the same screens.
Enable the IPS, choose rule categories, add country and domain policies, and watch the dashboard fill in.
Pre-orders are open. Email us your company name, how many units you need and where they ship, and we will reply with pricing and availability.