90% cost reduction.
Enterprise performance.

Sub-microsecond fast-path latency (2–5 µs measured in lab testing). No trade-off between security and HFT execution — full throughput benchmarks are in progress, see testing methodology.

• Up to 90% cheaper than legacy firewalls — ~120 MB Alpine Docker image, no hardware required.
• eBPF/XDP enforcement drops known-bad traffic before the host network stack is touched.
• Zero packet loss during automated policy updates — even in trading hours.
• Multi-source threat feed ingestion (abuse.ch, OTX, AbuseIPDB) integrated into day-to-day policy management.

Transform compliance from cost center to competitive advantage with advanced automation.

• Admin-controlled policy management with comprehensive audit logging for every rule and config change.
• Redis-backed threat indicator state with nftables enforcement sync — survives restarts.
• Config hot-reload applies TI settings and feed parameters live — no restart, no traffic interruption.
• 70+ Prometheus metrics with pre-built Grafana dashboards for compliance evidence and ops visibility.

Turn network infrastructure into revenue-generating security services.

• New revenue streams — premium "clean pipe" services vs. commodity internet.
• etcd-based HA clusters with active-passive leader election and ~2–3 s automatic failover.
• Multi-tenant architecture with isolated customer environments on shared infrastructure.
• REST/gRPC APIs for full automation of network operations and policy management.

Break free from legacy firewall margins with multi-tenant architecture and unified management.

• ~120 MB Alpine Docker image — deploy on commodity hardware, cut appliance costs entirely.
• Config hot-reload applies feed settings and policy changes live across all tenants — no per-customer restarts.
• JWT/RBAC multi-tenant authentication with Admin, Operator, and Viewer roles per environment.
• Unified threat intelligence — centralized feed management with Redis-backed indicator state across all customer environments.

• Attack surface reduction — inbound filtering at kernel speed before workloads are touched.
• REST/gRPC APIs and CLI for developer self-service policy management and automation.
• Domain-level blocking via Vaanvil — SNI/DNS L7 policy sync for malware disruption and content risk controls.
• SSE event streaming — real-time stats and threat update streams push to ops dashboards and alerting pipelines without polling.

• 70+ Prometheus metrics — DDoS counters, rule sync state, TI feed health, Redis hit rates, Vaanvil webhook events, and more.
• Pre-built Grafana dashboards for real-time traffic, drop reasons, threat activity, and system health — included in the deployment package.
• Per-interface XDP stats with drop-reason breakdown (Rate Limit, SYN Flood, Cost Filter, UDP, ACK, ICMP) visible in the UI and via API.
• Diagnostics endpoint — active rule inspection, chain handles, and eBPF monitoring status for deep incident triage.