SecureGuard is a next-generation firewall and unified threat management appliance. It runs on FreeBSD with pf as the packet filter, and its distinguishing property is that the whole system is described by a single canonical configuration document which every daemon's native config is rendered from.
What it is made of
The appliance does not reimplement routing, IKE, DHCP, DNS or intrusion detection. It orchestrates components that are already good at those jobs, and owns the model above them.
| Function | Component | Configured by |
|---|---|---|
| Packet filter, NAT, state | pf (FreeBSD base) | rendered pf.conf |
| Connection-state sync | pfsync (base) | rendered rc.conf |
| Dynamic routing | FRR (OSPF, BGP) | rendered frr.conf |
| IPSec / IKE | strongSwan | rendered ipsec.conf |
| WireGuard | wireguard-tools | rendered interface config |
| DHCP | Kea | rendered kea-dhcp4 JSON |
| DNS resolver | Unbound | rendered unbound.conf |
| IDS / IPS | Suricata | rendered suricata.yaml + thresholds |
| Web proxy / filtering | Squid, ClamAV | rendered proxy + ICAP config |
| Shaping and throttling | dummynet (base) | rendered QoS pipes |
| Remote-access VPN | OpenVPN, mpd5 | rendered client-VPN config |
| Monitoring | net-snmp | rendered snmpd.conf |
SecureGuard's own daemons are the control plane: configd owns the canonical document and the commit pipeline, apid exposes the management API the console talks to, flowd collects flow telemetry, and aid scores it and enforces the graduated response. had is the HA state machine — tested and shipping on Business+. mgmtd is the outbound agent for the free Orchestrator download, not a Business+ license feature. Status lines match HA and central management.
The one idea worth understanding first
Everything you do in the console is an edit to one document. Nothing is written directly to a daemon. On commit, the document is validated for referential integrity, each renderer turns it into that daemon's native text as a pure function, and only then does an applier write files and reload services — atomically.
That is why several things you would expect to be separate features are not: a preview is a render with no apply; a backup is a copy of a revision; an export for review is a revision, because a revision is readable JSON; a rollback is a revision id; and HA config sync is sending those revisions between two nodes.
Read this next: Architecture & commits explains the pipeline, the confirmed-commit window and the revision store.
Where to start
I want it running
Requirements, the image, first boot, and where the node ID comes from.
I have an activation code
The two-step licensing flow, tier entitlements, and what expiry does.
I am writing policy
Objects, zones, rule groups, tags, and why NAT is on its own screen.
I am evaluating the AI layer
The confidence model, the corroboration rule, and every guardrail.
Migrate from Sophos XGS
Free Windows app: open a Sophos Firewall backup, convert to SecureGuard JSON, simulate, export.
Orchestrator
Free Linux hub for a fleet of SecureGuard firewalls. Firewalls dial out; the hub never dials in.