KORTHVEILSecurity firewall
Sign in Get Korthveil
Features

A true layer-7 firewall,
professional and fully configurable

Korthveil decides by application, website, user and device, not only by address and port. Everything a commercial next-generation firewall does is here, configurable down to the last option, and explained in plain words.

See pricing All modules
Layer 7

It knows what the traffic is, and who it belongs to

A port-based firewall sees "TCP 443 to some address". Korthveil sees "Maria's laptop opening YouTube", "a phone asking a botnet server for orders", or "the accounting group uploading to an unapproved cloud drive". You write rules in those terms, and every decision can be explained.

  • Rules that match applications, URL categories, users and groups, host names and devices
  • Application identification from TLS and QUIC server names, HTTP hosts, DNS answers and packet content, with per-application usage
  • Intrusion prevention, web filtering, TLS inspection, anti-virus and sandboxing on the traffic you allow
  • Every block explained: which rule or module decided, and why

Port-based firewall vs Korthveil

QuestionPorts onlyKorthveil (L7)
Block YouTube for the TVs at nightGuess the addressesOne rule: kind TV → YouTube, schedule 23:00–05:00
Allow the sales group, not guestsBy IP rangesBy directory group
Stop a phone talking to a botnetNot seenIPS and threat feeds drop it, and name the device
Block gambling and malware sitesNot possibleURL categories, block page
See which app uses the bandwidthPort numbersApplications, users, rules
Why was this blocked?Search the logs"Blocked by your rule #6": the rule, devices and owner
Does my new rule work?Wait for complaintsThe flow chart shows the attempts it stops, live
Does this device really use the VPN?Traceroute and guessEvery conversation shows the tunnel or line it leaves through
Keep uploads of card numbers inNot possibleData loss prevention on decrypted uploads
🧠

Application identification

Classifies connections into applications, including QUIC (HTTP/3) and by packet content: SSH, BitTorrent, RDP, SMB, VPN protocols, WebRTC and SIP. Rules allow or block an application by name.

🌐

Web filtering

URL and domain categories per zone, user and group: block, warn or allow, custom categories, safe search, and a branded HTTPS block page.

👤

User and group rules

Maps addresses to users from Active Directory, LDAP, RADIUS, VPN and portal sign-ins, so rules follow people, not IP addresses.

🔐

TLS inspection

Transparent inspection of outbound HTTPS with its own certificate authority, privacy exemptions (banking, health) and strict origin checks.

🛡️

Data loss prevention

Checks decrypted uploads for card numbers, social security numbers, IBANs, private keys, cloud and API keys and your own keywords; logs or blocks, and never stores the data itself.

☁️

Cloud app security (CASB)

Discovers shadow IT and controls each SaaS application: block, allow for chosen groups, or monitor. Blocks are enforced in DNS and in TLS inspection, with a block page.

🏷️

Host names in rules

Use youtube.com or an object of host names in any rule; the firewall keeps their addresses up to date.

📺

Rules by device kind

Write "all TVs" or "all cameras" in a rule; the firewall recognises each device's kind and keeps the rule current as devices come and go.

📡

DNS tunnel and call-home detection

Finds data hidden in DNS queries and devices that keep calling unknown servers on a timer, and names the device.

🔀

Traffic flow chart

Each conversation drawn from device to rule to the tunnel or line it leaves through, with the attempts your rules block shown live.

🛰️

Zero-trust app access

Identity-aware access to internal web apps with OpenID Connect (Entra ID, Okta, Keycloak, Google, or an on-premises provider on your own CA) and per-app policies.

🧩

Endpoint integration

Reads device posture from Defender for Endpoint, CrowdStrike or SentinelOne, and quarantines at-risk devices automatically.

Firewall & rules

Rules you can see, test and trust

A stateful firewall on the Linux kernel's nftables, with IPv4 and IPv6 handled the same way in every feature.

Visual rule designerEvery rule drawn as a live flow from zone to zone, with moving arrows; press a rule to see only its path and whether it is working.
Easy and Expert modes"What would you like to do?" wizards ask one question at a time; experts get the full rule table.
Rule checkerFinds rules that are shadowed, redundant, never match or overlap, before you commit, with "Did you mean…?" corrections.
Auto rulesSuggestions from your own traffic: unused rules, broad rules narrowed to what is used, often-denied traffic, risky openings. Applied only after review.
Test a connectionEnter a source, destination and service; see exactly which rule decides, step by step.
Rules by device kindSources and destinations such as kind:tv or kind:camera, kept current from the device inventory without a commit.
ObjectsAddresses, ranges, networks, host names, groups, services and schedules, reusable everywhere, with inverted matches and source ports.
Zones and floating rulesZone-based policy, plus floating rules that apply across zones.
SchedulesRules active only at certain times and days, in the firewall's own time zone.
Rate and connection limitsPer-rule limits on new connections and concurrent sessions; DoS protection per zone and a SYN proxy for published services.
Hit counters and live trafficPackets matched and last hit per rule, measured traffic on the flow chart, and the attempts each deny rule stops.
Isolate a deviceCut one device off the internet for some minutes, keeping the local network.
Devices never blockedExempt a work computer from DNS interception, ad blocking and threat feeds, and route it straight out.
Atomic commitsChanges are staged, validated and applied all at once; a failed apply rolls everything back.
Safety rollbackIf a change cuts off your access, the firewall returns to the previous configuration by itself.
Revisions and change notesEvery commit kept with who, when and why; restore any revision.
Clear old connectionsWhen rules or routes change, connections on the old path can be verified and cleared.
Firewall's own trafficOutbound rules for the firewall itself, with automatic rules per service.
Import from pfSenseBring rules, objects, NAT, VPN and DHCP over from a pfSense backup.
Threat protection

Stops attacks, malware and scanners

Intrusion prevention (IPS)Suricata inline on allowed traffic with the Emerging Threats ruleset and your own rules; prevent or detect only. Go back to the previous ruleset after an update in one click.
Threat intelligence feedsSpamhaus DROP, abuse.ch Feodo, DShield, FireHOL, IPsum, blocklist.de, CINS Army, Emerging Threats compromised hosts, Tor exits and custom feeds, IPv4 and IPv6, inbound and outbound, with an allowlist.
DNS tunnel and call-home detectionSpots data smuggled out through DNS and regular "beacon" connections to unknown servers, and raises an alert naming the device.
Data loss preventionCard numbers (Luhn-checked), SSNs, IBANs, private keys and API keys in decrypted uploads are logged or blocked; payment processors can be allowed.
Geo filterBlock or allow by country (grouped by continent), state and city, network owner (ASN), and lists of VPNs, hosting networks and Tor exits.
Gateway anti-virusClamAV scanning of downloads and mail, with signature updates.
Sandbox connectorFile lookups and submission to CAPEv2, VirusTotal or your own sandbox, with cached verdicts.
Web application firewallThe OWASP Core Rule Set and custom rules in front of your published web apps, with learning mode and reports.
Email security gatewayInbound SMTP filtering: SPF, DKIM, DMARC, DNS blocklists, greylisting, attachment blocking and anti-virus.
Edge protectionReverse-path checks and dropping of impossible and spoofed source addresses on internet ports.
Privacy shieldUntrusted sites without cookies or tracking, with disarmed downloads.
"Blocked by your rule" or an attack?Cards say plainly when your own rule blocked something, and list the busiest scanners with owner and country, with one-click Block it.
NAT

Every kind of address translation

Port forwardingWith allowed sources, ranges, reflection (hairpin NAT) and a SYN proxy.
Source NATAutomatic, hybrid or manual outbound NAT, per interface and per rule.
1:1 NATMap public addresses to internal hosts.
NPTv6, NAT64 and DNS64IPv6 prefix translation, and IPv6-only networks reaching IPv4 services.
Gaming and appsUPnP IGD, NAT-PMP and PCP for Open NAT, per device, with presets and live port mappings.
Application gatewaysSIP, H.323, FTP, TFTP and PPTP helpers.
Routing & WAN

Multiple lines, tunnels and routing domains

Policy-based routingSend chosen devices, sites or applications through a chosen line or VPN tunnel.
Gateway groupsFailover, weighted load balancing, or the fastest member by ping, with a kill switch so traffic never leaks.
VPN providersNordVPN, IPVanish and any WireGuard provider, one tunnel per account, guided by a wizard.
SD-WANLink health with SLA probes, history, failover order and per-traffic steering.
Dynamic routingBGP (with BFD, route maps, prefix lists, communities), OSPFv2, OSPFv3, RIP and RIPng.
Static routes with trackingRoutes withdrawn automatically when their gateway stops answering.
VRFsSeparate routing domains on one firewall.
Cellular WANLTE and 5G modems as a main or backup line, with signal and data usage.
Phone as backup internetPlug in an iPhone or Android phone; it takes over when the main line fails and hands back by itself. Its own internet is checked every 5 minutes while it stands by, and Test backup now checks it at once.
InterfacesVLANs, bridges, bonds (LACP), loopbacks, GRE tunnels, SFP/SFP+ with transceiver details, MAC cloning.
Transparent and tap modesRun as an invisible layer-2 bridge, or watch a mirror port passively.
QoS and traffic shapingCAKE shaping of uploads and downloads with voice, video, best effort and bulk classes.
VPN

Connect sites, people and phones

WireGuardSite-to-site and remote devices, with QR-code enrollment for phones and live tunnel status.
IPsec site-to-siteIKEv2 (and IKEv1) with pre-shared keys or certificates, route-based or policy-based; certificate revocation lists downloaded and checked, with strict checking per tunnel.
IKEv2 remote accessFor the VPN clients built into Windows, macOS, iOS and Android.
OpenVPNOpenVPN 2.6 servers with downloadable profiles and certificates issued for you.
SSL VPNOpenConnect and AnyConnect-compatible access for networks that block other VPNs.
Tor gatewaySend chosen devices or zones transparently through Tor, with nothing leaking around it.
Identity & access

Who connects, with what, and when

Network access control (802.1X)EAP-TLS, PEAP and EAP-TTLS for switches and Wi-Fi, MAC bypass for printers, dynamic VLANs by group, and devices the firewall recognises (TVs, cameras, printers) moved to their own VLAN automatically.
Device certificatesOnly devices whose certificate is still valid get in; allow, block, expire or limit devices by the hour. SentinelOps can issue, renew and revoke certificates for the machines it manages.
DirectoriesActive Directory, Samba AD, FreeIPA and LDAP, set up once and used everywhere.
Guest portalTerms acceptance, vouchers, sponsor approval by email, self-registration and time limits.
Self-service portalEmployees sign in to get their VPN profile and apps.
Wi-FiAn access point on the firewall's own radio, and a controller for access points: WPA2/WPA3, Enterprise, guest isolation.
Switch managementSee switch ports, VLANs, MAC tables and neighbours, and set a port's VLAN.
Administrator sign-inLocal accounts with roles, two-factor sign-in, LDAP, RADIUS, TACACS+, OpenID Connect and SAML single sign-on, and a management allowlist.
DNS & DHCP

Private, filtered name resolution

DNS resolverRecursive or forwarding, DNSSEC, encrypted DNS over TLS to Quad9 or Cloudflare, local records and split horizon.
Ad and tracker blockingBlock lists for ads, trackers and malware, monitor mode, exempt devices and a per-device view.
DNS interceptionDevices that ignore your DNS settings are answered by the firewall anyway.
DHCP server and relayDHCPv4, DHCPv6 and router advertisements, reservations, and relay to other servers.
Dynamic DNSKeeps your names pointed at changing IPv4 and IPv6 addresses, with more than twenty providers.
DNS forwarderA lightweight alternative for small networks.
Visibility

See everything, live

Live dashboardCPU, memory, disks, interfaces, connections and devices by kind, with animated live graphs; arrange it your way.
Traffic flow chartWho talks to whom, through which rule and which way out, measured every 2 seconds, with history. See below.
AnalyticsTop sources, destinations, protocols and applications over 24 hours, 7 and 30 days.
AlertsHealth, disk (SMART), memory (ECC), interface errors, certificates and failed commits, by email and webhooks.
ReportsPDF, CSV, HTML and JSON reports and exports, on demand or scheduled to email, SFTP or S3.
LogsFirewall and system logs, a syslog server for your devices, and export to your SIEM.
Flow exportNetFlow v9 and IPFIX to your collectors.
MetricsA Prometheus endpoint and OpenTelemetry push.
DiagnosticsPing, traceroute, DNS and port tests, the connection table, packet capture and a support bundle.
Audit logEvery sign-in, sign-out, change and action, with who, when and from where; each entry chained to the one before by its hash, so any tampering shows, with a Verify button.
Traffic flow chart

Every conversation, in and out, and where it leaves

The flow chart draws your traffic as bands from device, to rule, to the way it leaves, to the destination. It is built for the moment you write or test a rule: you see at once what it lets through and what it stops.

  • How traffic leaves: each conversation shows the VPN tunnel, internet line, phone backup or local network it goes through, with totals per way out; click one to see only its traffic
  • What your rules block: blocked attempts over the last 1, 5, 15 or 60 minutes as dashed red bands through the rule that stopped them, with the number of tries
  • Direction: outbound to the internet, inbound from it, or between your own networks
  • Devices by name, kind and maker, not only addresses
  • Search by device, rule, application or way out, colour by any column, and step back through the history

Typical questions it answers

  • Is the TV really going through the VPN, or straight out?
  • My new deny rule: how often does it fire, and from which devices?
  • What is coming in from the internet, and through which rule?
  • Which device uses the bandwidth right now, and on which line?
High availability

Built to stay up

Failover pairTwo firewalls with shared addresses (VRRP), connection-state sync and configuration sync; the standby takes over in seconds.
Fast, safe updatesKorthveil updates install live in about 15 seconds; system updates use A/B slots with a health check and automatic fallback.
Encrypted backupsScheduled to email, SFTP, Amazon S3 or a Git repository; restore onto new hardware with ports matched automatically.
Network storageiSCSI, NVMe over TCP and SAN volumes for add-in data, encrypted in transit and at rest.
UPS supportWatches your UPS and shuts down gracefully before the battery runs out.
Installs keep your settingsReinstalling never erases an existing configuration.
Management

Configurable everywhere, simple anywhere

Web consoleDark and light themes, search for any setting, help and guides on every page, works on phones.
WizardsStartup, networks, VPNs, VPN providers, enterprise Wi-Fi, DNS filtering, publishing a server.
Command lineA full CLI over SSH and on the console, with single sign-on.
AI assistantAsk questions and get rule proposals from Claude or your own model; it never commits by itself.
Remote managementSentinelOps and Korthveil Central for fleets: inventory, health, remote configuration and updates.
Virtual systemsSeveral isolated tenants on one firewall, each with its own rules and logs.
Zero-touch provisioningNew firewalls configure themselves from signed documents; network install over PXE.
CertificatesA local CA, imports, signing requests and Let's Encrypt certificates (automatic, or by hand for DNS hosts without an API), assigned to every service; the console can serve a certificate per name.
Sign-in noticeYour legal or advisory notice shown before sign-in on the web console, SSH and the local console, optionally to be accepted.
Cryptographic self-testsKnown-answer tests of the hashing, encryption and signing at every start, recorded in the audit log, with an alert on failure.
Port detectionShows what is connected to each port, swaps WAN and LAN, and blinks a port's light to find it.
Platform

Your hardware, your firewall

Any 64-bit computer or virtual machine that Debian 13 supports, with two network interfaces. Korthveil runs on Debian 13 with its own Linux 6.18 kernel and the nftables data plane.

Core firewall

2 cores, 4 GB RAM, 32 GB disk.

With IPS, WAF or the Full Suite

4 or more cores, 8 GB RAM, 64 GB disk.

Virtual machines

KVM, Proxmox, XCP-ng and VMware, with two virtual network cards.

Ready to see it on your network?

Start with the Core firewall and add exactly the modules you need, or take the Full Suite.

Build your license Read the guides