Rollback by id

Undo a firewall change in one step.

A next-generation firewall / UTM you run on hardware you own. One canonical document. A human commits. Rollback is an id, not a salvage job.

Every committed state is an immutable snapshot, addressed by the hash of its canonical JSON, with a parent pointer and an author. Re-applying an earlier one is the whole of rollback. A commit may arm a confirm window that auto-reverts if you get locked out. By default, AI suggests changes and a person approves each one. On Business and Enterprise you can turn on automatic blocks, which act only when two signals agree, are rate-limited, and expire on their own.

Your policy in one validated configuration, not a pile of separate files.
Validate, preview the rendered daemon diff, commit atomically.
Rollback by id. Content-addressed revisions. Re-apply an earlier snapshot.

Teams leaving Sophos UTM: Sophos UTM replacement. Same FreeBSD and pf foundations, commercial orchestration: vs OPNsense / pfSense. Short answers on the FAQ. What is actually built: Platform.