Protect internet-facing services against unwanted traffic, DDoS attacks, and network threats using a lightweight, Linux-native firewall platform.
Neurowall is a gateway firewall designed to secure cloud, edge, and hybrid environments. Unlike traditional firewall appliances, Neurowall runs on standard Linux infrastructure and is built to deliver fast packet processing, centralized policy management, and flexible deployment options.
Built using eBPF and XDP — modern Linux networking technologies that process packets at the kernel level, before they consume system resources.
Maintained full ISP line rate with 272,139 active rules loaded. No throughput reduction.
Active-passive failover in under 3 seconds. Services keep running if a node fails.
Deploy on any Linux server and have your first firewall rule running in under 15 minutes.
Runs on servers, VMs, and cloud instances you already operate. No appliances to buy or refresh.
Deploy on AWS, Azure, GCP, or any cloud provider's Linux instances. Same policy, same management, any region.
Block malicious traffic, rate-limit abuse, and stop DDoS attacks before they reach your API endpoints.
Deploy as a DaemonSet on ingress nodes. Filter at the XDP layer before traffic reaches application pods.
Standard Linux hardware at each location. Centralized policy management from one control plane, no per-site consoles.
Replace proprietary appliances with a Linux-native gateway firewall. No hardware refresh cycles, no vendor lock-in.
Per-customer policy isolation via REST API. Deliver firewall-as-a-service on infrastructure you already operate.
Protect the boundary between the internet and your internal network. Block threats at the edge before they reach anything internal.
Stop unwanted traffic before it impacts applications. DDoS attacks are absorbed at the network edge — your services keep running.
Manage policies centrally across multiple gateways from one control plane. One REST API, one web UI, consistent policy everywhere.
Deploy on commodity hardware or cloud instances instead of proprietary appliances. No hardware refresh cycles. No per-appliance licensing.
Scale using standard Linux infrastructure. Add capacity by deploying another Linux instance — no appliance procurement, no vendor engagement.
Detailed capability breakdown below. Technical depth is available — after you understand what Neurowall does for your business.
No special hardware required. Deploy on infrastructure you already operate.
Neurowall runs on standard Linux servers, VMs, and cloud instances you already operate. No appliances to procure, rack, or refresh.
AWS, Azure, GCP, on-premises, bare metal, Kubernetes ingress nodes, edge locations — the same Neurowall binary, the same REST API, everywhere.
eBPF and XDP process packets at the driver level — before the kernel's full network stack — on the same Linux infrastructure your applications already run on.
| Environment | Deployment Method |
|---|---|
| Cloud (AWS, Azure, GCP) | Linux VM or instance in VPC / VNet |
| On-premises | Bare metal server or virtual machine |
| Hybrid | Mix of cloud and on-premises — managed from one control plane |
| Virtual Machines | VMware, KVM, Hyper-V, or any hypervisor running Linux |
| Bare Metal | Standard x86_64 Linux server — no proprietary NIC required |
| Kubernetes Ingress | DaemonSet on ingress nodes — scales with the cluster |
| Traditional Firewall | Cloud Firewall | Neurowall | |
|---|---|---|---|
| Hardware required | Yes | No | No |
| Linux-native | No | Partial | Yes |
| API-first | Limited | Good | Yes |
| High-performance packet processing | Good | Good | Excellent |
| Flexible deployment | Limited | Cloud only | Cloud + On-prem + Bare-metal |
Built entirely on modern Linux kernel technologies — no appliances, no licensing games.
5-tuple rules (src IP, dst IP, src port, dst port, protocol) synced atomically to both the eBPF/XDP fast path and nftables stateful path. Full IPv4 and IPv6 support — CIDR ranges, port ranges, allow/deny/drop actions, per-rule counters, and rollback on failure.
Token-bucket rate limiting plus six flood-specific modules: SYN, ACK, ICMP, FIN, RST, and UDP cost filter. FIN and RST are off by default. All thresholds tunable at runtime — changes apply in under 30 seconds with no traffic interruption. Fragment bomb defense included.
Pulls indicators from abuse.ch, AlienVault OTX, AbuseIPDB, and compatible sources. IP indicators push directly into the kernel blocklist. URL extraction pipeline parses raw feed URLs into domain blocks. Redis-backed caching survives restarts. Integrity-check API flags null-epoch rows, expired leaks, and allow-field anomalies.
Vaanvil enforces domain blocks at Layer 7 via SNI inspection and DNS interception. Blocks can be global, source-scoped (block a domain only for a specific IP/CIDR), or destination-scoped. Blocked domains sync automatically to a local Unbound sinkhole so DNS resolution is also intercepted.
Admin (full access), Operator (rules + policy, own password), Viewer (read-only). Every state-changing operation is written to an immutable audit log with user identity and timestamp. Config hot-reload applies TI settings, feed parameters, and sidecar config live — no restart, no traffic interruption.
Leader election via etcd with ~2–3 s failover. Rules, threats, and config replicate to all cluster members via etcd watches. If etcd becomes unavailable, each node continues independently with its last-known state. Standalone mode is fully supported — no cluster required.
Metrics cover request latency, rule/threat counts, eBPF packet totals, DDoS counters, Redis hit rates, HA events, TI URL ingestion, DNS sink sync, Vaanvil webhook events, and more. Pre-built Grafana dashboards and SSE endpoints for real-time stats streaming to ops dashboards.
Static route lifecycle management for controlled pathing. Masquerading/NAT with POSTROUTING rule management. Port forwarding provisioning via the firewall UI. WireGuard VPN peer management and config for site-to-site or admin access into protected networks.
Each UDP packet is scored by payload size and service type — DNS, NTP, Memcached, and others. Sources accumulating excessive cost scores are rate-limited before they can amplify against a target. Thresholds are configurable per service profile.
Real screenshots from a production Neurowall instance. DDoS Guard with eBPF/XDP rate limiting, system telemetry with sync-failure alerting, and live L7 verdict streaming — all built into the admin surface.
Peer management and config screens for site-to-site or admin VPN access into protected networks.
Blocked TI domains sync to a local Unbound instance in real time — DNS resolution is intercepted alongside L7 packet drops.
Port forwarding rules provisioned directly from the firewall UI. Managed alongside allow/block rules in the same policy surface.
POSTROUTING masquerade rules with automatic discovery and mapping of NAT entries. Managed from the network surface.
Apply TI settings, feed parameters, URL ingestion policy, and sidecar config live — no restart, no traffic interruption.
Webhook ingestion, managed L7 policy writes, and sync status for the SNI/DNS domain enforcement engine.
Rule reconciliation failures surface as persistent nav badges until acknowledged or resolved.
Snapshot rules, threats, and config to local storage or S3. Gzip-compressed, differential, checksum-validated before restore.
Captured from a production Neurowall instance — eBPF/XDP enforcement active across 272K rules, three consecutive 2.88 GB downloads from an external mirror clocked back-to-back. Constant line-rate throughput, no degradation between runs.
// data plane: eBPF/XDP + nftables // no kernel bypass, no userspace proxy
One verified benchmark so far. Throughput and latency figures will be published as formal benchmarks complete — hardware, NIC, driver, and XDP mode all affect results.
Full operational monitoring is built and running. System health, per-interface XDP counters, and live L3/L7 event telemetry are all available in the admin surface today.
Single screen: uptime, health status, HA mode, active interface count, CPU/memory/disk gauges, a 50-second rolling throughput graph, and a live traffic-flow diagram showing IN/OUT split between internet and hosts.
Total packets, allowed vs. dropped split, byte totals, and a full drop-reason breakdown — Rate Limit, SYN Flood, Cost Filter, UDP, ACK, ICMP — so you can see exactly why traffic isn't reaching the host. Auto-refresh at 5s, 10s, or 30s.
Verdict-timeline chart over any time window, a live event stream with src/dst IP, port, protocol, SNI, and JSON extras, plus verdict distribution and top SNI/host breakdown. Filter by IP, port, SNI, verdict, or date range. Switch between L3 and L7 views.
From security to SRE to managed providers — Neurowall slots into existing workflows.
Stop attack traffic at the edge and produce an immutable audit trail that shows exactly what was blocked, when, and why. Respond faster because the controls are simple.
REST API, CLI, and Prometheus metrics mean Neurowall fits into existing Terraform, Ansible, and Grafana workflows. No specialist firewall knowledge required.
Offer firewall-as-a-service and DDoS protection as paid add-ons. Per-customer isolation via API means you can scale to any number of tenants without manual configuration.