Appliance OS · FreeBSD + pf

A next-generation firewall you install on hardware you own.

Your firewall's configuration should be one document. SecureGuard is an object-based, zone-aware next-generation firewall and UTM appliance. It does not reimplement pf, FRR, strongSwan, Kea, Unbound or Suricata — it owns the one canonical document all of them are rendered from, so a change is validated, previewed, applied atomically and reversible by id.

Get a free license Buy licenses

Runs on your own hardware or hypervisor. Licenses are node-locked and verified on the box against an embedded vendor key — no phone-home to pass traffic. secure-guard.io

Firewall ▸ Rulespreview diffcommit (confirm 10m)

Threat control1 rule

any → any<rubix_blocklist> → any : anydrop#quick

LAN access2 rules

LAN → WANlan-net → any : anyacceptlog#egress

LAN → locallan-net → firewall : dnsaccept#infra

Published services1 rule

WAN → DMZany → web-server : httpsacceptlogIPS#inbound

Not an IP address in sight. Rename web-server and every rule that references it follows. Move an interface between zones and no rule is rewritten.

Sophos partners: XGS hardware +10% from November 1.

Term and upfront November 1, 2026. MSP January 1, 2027. Related subscriptions included. Email +7.5%. Price lists publish in October.

SecureGuard runs on hardware you own. Community is $0. Free XGS backup converter — Migrate from Sophos XGS.

Coming soon

Application control — Named applications, not only hostname, SNI, and DNS.
Anti-spam — Not on the appliance today.
Identity in policy — User or group as a traffic match. Directory login on Business+ already ships; this does not.
Off-box analysis — Behavioral models beyond on-box propose/commit.
Orchestrator / fleet hub — Free Linux download today (firewalls dial out; hub never dials in). Not a Business license feature and not a paid CM SKU.
Endpoint email-alert ingest — Orchestrator will capture AI-summarized alerts from any endpoint protection email stream. Coming soon. Not shipping.

Not App-ID. Not AntiSpam.

1 document

The whole system, rendered into every daemon's native config

BYO hardware

Install on hardware or a hypervisor you own. We do not sell Guard appliances

Rollback by id

Every config state is a content-addressed revision you can re-apply

2 signals

Independent corroboration required before the AI layer is allowed to act

The engine

Validate, render, apply — from one document

Most appliances let you edit each daemon's world separately and hope the result is coherent. SecureGuard keeps one document and treats every daemon's config as output. That single decision is what makes preview, rollback, backup and export fall out of one place instead of being four features.

Nothing is configured directly. Every config state is an immutable, content-addressed snapshot with a parent pointer, so backup is a copy, export is a readable JSON document, and rollback is an id. HA config sync ships those revisions between nodes on a Business+ cluster.

The operator model

The management UI is the product

If the console is not intuitive, none of the engine underneath matters. Six rules are binding on every screen — and each one is a decision about what you should never have to hold in your head.

Objects, not addresses

You build named hosts, networks, ranges, groups and services once and reference them everywhere. Rename an object and every rule that uses it follows. No raw IPs scattered through a ruleset for someone to grep for at 2am.

Zones, not interfaces

Policy reads LAN → WAN, not em1 → em0. Moving an interface between zones never rewrites a rule, so re-cabling a site is a topology change instead of a policy migration.

NAT lives away from policy

Masquerade/source-NAT and port forwards get their own screens, never interleaved with filter rules. This is the single biggest source of firewall confusion, and it is removed by design rather than documented around.

Preview before you commit

Every change shows a diff of the rendered daemon config and the services it will reload. A commit can also arm a confirm window: change a rule remotely, lose your own session, and the box puts the previous revision back by itself.

Every state is a revision

Config states are immutable, content-addressed snapshots with a parent pointer and an author. Backup is a copy. Export for review is a readable JSON document. Rollback is an id.

One click to a live log

Every service row has a Live button that streams that component’s log, filterable down to a single firewall rule’s label. Answering "is this rule matching?" should not require SSH and tail.

What the rule above actually becomes. The rendered ruleset carries the rule's own label, so a live log filtered to one rule maps straight back to the row you clicked.

# rendered from the "Published services" group
table <rubix_blocklist> persist
block drop quick from <rubix_blocklist>

pass in quick on igb0 inet proto tcp \
  from any to <addr_web-server> port 443 \
  synproxy state (max-src-states 500, \
    max-src-conn-rate 100/10, \
    overload <rubix_blocklist> flush global) \
  log label "wan-to-dmz-web"

SYN floods are answered by the firewall on the host's behalf, per-source connection rates trip an overload into the shared blocklist table, and one rule at the top of the ruleset drops everything in it. Flood and recon protection →

AI security

An automatic block is an attack surface. So we throttle first.

A machine-learning score that drops traffic on its own can be gamed into dropping your traffic. SecureGuard fuses independent signals into a confidence score, and confidence maps to a tier that is bounded by an autonomy level you set. The default is to propose, not act.

Observe

Low or medium confidence — log it and move on

The event is recorded and surfaced in the console. Nothing about the running configuration changes. During the initial learning window the whole layer stays here, because there is no baseline yet to judge against.

Suggest

High confidence — propose a change for a human

The harness drafts the block or rule as a config diff with its rationale and a risk rating. An operator approves it, and it goes through the same validate → render → apply path as any hand-made change.

Throttle

Grey and suspect — degrade it, do not cut it

The source joins the greylist table, which is piped to a slow dummynet queue. If that was a false positive the collateral is a slow connection, not an outage. Repeat offenses or rising confidence escalate to a block; quiet sources age out.

Block

Two independent signals agree — drop it, with a timer

The source lands in the blocklist table that a single top-of-ruleset rule drops. Automatic blocking needs an opted-in category and corroboration; management addresses, HA peers and operator allowlists are never eligible. Every entry expires and every action has one-click undo.

Inference stays off the box

No model weights and no ML runtime on an appliance whose job is passing packets. Telemetry goes to your own private endpoint or a frontier API — your routing choice, per purpose.

Signals you can name

Confidence is fused from independent signals — signature severity, threat-intel reputation, and on-box volume and peer facts. A lone signal stays in the grey band. Two have to agree before the layer is allowed to act.

Every action explains itself

Each decision carries the features that drove it, an audit entry, a TTL and one-click undo. A model or feed outage degrades to the deterministic path — it never fails open.

How the confidence model works

The rest of the box

Everything else a perimeter has to do anyway

All of it modeled in the same document, validated by the same gate and rendered by the same engine — so none of it is a bolt-on with its own idea of what the network looks like.

Network

Routing and uplinks

Static routes, gateways and gateway groups for multi-WAN failover and load balancing, policy routing per rule, OSPF and BGP through FRR, DHCP through Kea, DNS through Unbound.

Connectivity

Tunnels, every flavour

IPSec and IPSec VTI via strongSwan, WireGuard, SiteLink, remote-access client VPN, Tailscale, cloud VPN and an Amazon VPC attachment — all modeled in the same document as the rules that police them.

Content

Web Filter, Safe Search, DoH

Community licenses Web Filter, Safe Search, and DoH block, plus Suricata IPS. Hostname, SNI and DNS filtering work without decrypt. Path and file-type rules need TLS inspection, which is shipping: Squid ssl-bump, on-box intercept CA, :443 redirect, QUIC drop, zone scope, and banking/health/gov splice.

On Community · TLS inspection shipping

Intelligence

Threat feeds and GeoIP

Paid tiers license priority updates and threat feeds. feedd pulls IP EDLs into pf tables, plus GeoIP and classify-only feeds.

Shipping on Home+

Availability

Active/passive HA

One system-wide toggle, one dedicated HA port, two nodes holding byte-identical config. Failover is layer-2 MAC/IP takeover — one cluster IP and MAC per segment, no CARP, no VHIDs, no advskew. Config and pf state sync. Tested and shipping.

Shipping on Business+

Visibility

Flows, logs and reports

Flow telemetry from pf state and pflog plus Suricata EVE events, a bounded live ring buffer per service, rotating files on disk, optional remote syslog, and traffic reports over the same data.

Lifecycle

Upgrades that can back out

A signed system image lands in a new ZFS boot environment and is activated for next boot. A health check confirms it or the box rolls back to the environment that was working.

Image build ships

Licensing

Community is the same image, not a trial timer

Every tier runs the same image; the license decides scale and features. Community is perpetual and never throttled, so a lab or first-site install is a real appliance, not a trial timer — and paid tiers add the scale and features a production perimeter needs. Which plans are on offer, and at what price, comes live from the license catalog.