Add exactly what you need
Some modules come with every Korthveil Core. The others can be added one by one, or all at once with the Full Suite.
Application identification
Classifies connections into applications from TLS and QUIC server names, HTTP hosts, DNS answers, packet content signatures (SSH, BitTorrent, RDP, SMB, VPN protocols, WebRTC, SIP, MQTT) and port fallbacks; reports application usage, detects call-home connections to unknown servers, and keeps per-application address sets for policy, QoS, CASB, and web filtering. IPv4 and IPv6.
Add-on module
Cloud app security (CASB)
SaaS discovery (shadow IT) from Application control classifications with users from User identity, and per-application controls: block (DNS, TLS SNI, optional address set), read-only and no-upload (with TLS inspection). IPv4 and IPv6.
Add-on module
Endpoint security integration
EDR posture from Microsoft Defender for Endpoint, CrowdStrike Falcon, SentinelOne, or signed webhooks; quarantines at-risk devices (IPv4 and IPv6) in the firewall.
Add-on module
Gateway anti-virus
Malware and spyware scanning with ClamAV for downloads (through tls-inspection or its own HTTP proxy) and mail (through mail-security), with signature updates by freshclam.
Add-on module
Intrusion prevention (Suricata)
Inline intrusion prevention or detection with Suricata on NFQUEUE for allowed forwarded traffic, with the Emerging Threats Open ruleset and custom rules.
Add-on module
Email security gateway
Inbound SMTP security gateway: STARTTLS, recipient-domain allowlist (no open relay), DNSBL, SPF, DKIM, DMARC, greylisting, attachment blocking, ClamAV, optional Rspamd and sandbox, quarantine, and relay to the internal mail server.
Add-on module
Sandbox connector
SHA-256 lookups and sandbox submission (CAPEv2, VirusTotal, REST webhook) for files from gateway-av and mail-security, with cached verdicts and a hold-until-verdict policy.
Add-on module
Threat intelligence feeds
IP blocklist feeds (Spamhaus DROP, abuse.ch Feodo Tracker, DShield, FireHOL, IPsum, blocklist.de, CINS Army, Emerging Threats compromised hosts, Tor exits, custom URLs) enforced as a dynamic set, inbound and outbound, IPv4 and IPv6.
Add-on module
TLS inspection
Transparent inspection of outbound HTTPS and HTTP: certificates minted from the module's CA, privacy exemptions, strict origin verification, malware scanning through gateway-av, data loss prevention on uploads (card numbers, SSNs, IBANs, private and API keys, keywords), and CASB block pages.
Add-on module
Web application firewall
Inspects requests to web applications published by the reverse proxy with the OWASP Core Rule Set and custom rules, and blocks attacks such as SQL injection and cross-site scripting.
Add-on module
Web filtering
URL and domain category policy per zone, user, and group (block, warn, allow), custom categories, safe-search enforcement data, and a customizable HTTP and HTTPS block page on an automatic block address (HTTPS certificates from the module's own CA, only for blocked names). Enforced through dns-filter (DNS) and tls-inspection (SNI/HTTP).
Add-on module
Zero trust application access
Identity-aware access to web applications published by the reverse proxy: OpenID Connect sign-in (Entra ID, Okta, Keycloak, Google) and per-application user and group policy.
Add-on module
Cellular WAN (LTE/5G)
LTE/5G modems as a primary or failover uplink: SIM PIN, APN profiles, connect and disconnect, signal and registration status, and monthly data usage with a cap warning (ModemManager). Requires an LTE/5G modem.
Add-on module
Dynamic DNS
Keeps DNS names pointed at the firewall's changing public IPv4 and IPv6 addresses: the dyndns2 protocol (No-IP, Dyn, and twenty more presets), Cloudflare, DuckDNS, RFC 2136 with TSIG, and the APIs of Namecheap, GoDaddy, DigitalOcean, Hetzner, Porkbun, Gandi, Linode, Route 53, DNSimple, Vultr, Name.com, FreeDNS, or a custom update URL.
Included in Core
DHCP server and relay
DHCPv4 and DHCPv6 (ISC Kea) and IPv6 router advertisements (radvd) for networks behind the firewall.
Included in Core
DNS resolver and filtering
Recursive or forwarding DNS resolver (Unbound) for networks behind the firewall: DNSSEC, DNS over TLS upstreams, local host records, split-horizon domains, blocklists, and optional DNS interception.
Included in Core
DNS forwarder
Caching DNS forwarder (dnsmasq) for networks behind the firewall: upstream servers, host and domain overrides, DHCP client names, optional DNS interception. Off by default; the alternative to the DNS resolver, which cannot run at the same time.
Included in Core
High availability (firewall pair)
Active/passive pair of two Korthveil firewalls: VRRPv3 virtual addresses for IPv4 and IPv6 (keepalived), connection-state sync over a dedicated HA link (conntrackd FTFW), interface and path monitoring, and manual failover. Requires a second Korthveil firewall.
Included in Core
QoS and traffic shaping
CAKE shaping of WAN uploads and downloads, and Voice / Video / Best effort / Bulk classification by DSCP.
Add-on module
Reverse proxy
Publishes internal web applications with TLS termination, ACME certificates, load balancing, health checks, and the web application firewall and zero trust access add-ins.
Add-on module
Dynamic routing (BGP, OSPF, RIP)
BGP (IPv4/IPv6 unicast, BFD, route maps, prefix lists, communities), OSPFv2, OSPFv3, RIP and RIPng with FRRouting.
Add-on module
SD-WAN
Multi-WAN link health with SLA probes (ICMP and HTTP(S), IPv4 and IPv6), link state history, failover order, weighted load balancing, and per-traffic steering.
Add-on module
Switch management
Discovers SNMP-manageable switches and shows their ports, VLANs, MAC tables and LLDP neighbours; sets a port's access VLAN through Q-BRIDGE-MIB where allowed, with confirmation and an audit trail. Requires SNMP-manageable switches.
Add-on module
Gaming & apps
Lets games, consoles, and voice and peer-to-peer applications open the ports they need automatically, for Open NAT: UPnP IGD, NAT-PMP, and PCP with IPv6 pinholes. Only on the networks you choose, only for the asking device, within limits; every mapping is listed live and can be removed.
Included in Core
Wireless controller
Adopts and manages access points: SSIDs mapped to firewall VLANs and zones (WPA2/WPA3 personal, WPA-Enterprise through the NAC add-in, OWE, guest isolation), radio settings, and live AP, client and signal status. Requires access points (OpenWrt-based today, with uhttpd-mod-ubus and rpcd).
Add-on module
IPsec site-to-site VPN
IKEv2 (and legacy IKEv1) site-to-site tunnels with strongSwan: pre-shared keys or certificates, route-based (XFRM interface per tunnel) or policy-based, IPv4 and IPv6.
Add-on module
OpenVPN
OpenVPN 2.6 servers for remote access (certificates issued by the add-in, optional passwords, downloadable .ovpn profiles, IPv4 and IPv6 pools, split or full tunnel) and OpenVPN client connections from the firewall to other servers.
Add-on module
IKEv2 remote-access VPN
VPN gateway for the IKEv2 clients built into Windows, macOS, iOS, and Android (strongSwan app): EAP-MSCHAPv2 users, certificates, or RADIUS; IPv4 and IPv6 address pools; split or full tunnel; generated client profiles.
Add-on module
SSL VPN (OpenConnect)
TLS remote-access VPN for networks that block IPsec and WireGuard: ocserv for OpenConnect and AnyConnect-compatible clients, local users or RADIUS, IPv4 and IPv6 pools, split or full tunnel.
Add-on module
Tor gateway
Sends selected clients, or whole zones, transparently through the Tor network (TCP and DNS), and blocks everything else they send so nothing leaks around Tor.
Add-on module
WireGuard VPN
WireGuard tunnels with the in-kernel implementation: site-to-site peers, remote devices with QR-code enrollment, and live tunnel status. Not available in FIPS mode.
Included in Core
Guest services
Captive portal for guest zones: terms acceptance, vouchers, sponsor approval by email, self-registration, and session time limits.
Add-on module
User identity
Maps IP addresses (IPv4 and IPv6) to users and groups from LDAP/Active Directory, RADIUS accounting, syslog login events, static mappings, and VPN logins, and keeps one address set per policy group for user-based policy and reporting.
Add-on module
Network access control (802.1X)
802.1X RADIUS server for switches and access points (EAP-TLS, PEAP-MSCHAPv2, EAP-TTLS), MAC Authentication Bypass, dynamic VLANs by group, guest VLAN, VLANs by recognised device kind (TV, camera, printer), RADIUS Disconnect, and RadSec. Uses the operating systems' own supplicants: no endpoint agent.
Add-on module
Self-service portal
Employee self-service: sign in with the directory, single sign-on, or a NAC-verified company device (with TOTP), and use apps from other add-ins such as VPN enrollment with QR codes.
Add-on module
Flow export
NetFlow v9 and IPFIX export of connection records from conntrack to IPv4 and IPv6 collectors.
Add-on module
Syslog server
Collects syslog (RFC 5424 and RFC 3164) from machines behind the firewall over UDP, TCP, and TLS, IPv4 and IPv6, and keeps it in the firewall database with retention, search, and export.
Add-on module
Analytics
Top sources, destinations, protocols, and applications by port over 24 hours, 7 days, and 30 days, from finished connections.
Add-on module
AI assistant
Ask questions about this firewall, get help setting it up, and troubleshoot it with an AI model you choose: Anthropic Claude with your own API key, or a local model. It reads the firewall through read-only core operations and proposes changes as pending changes you review and commit; it never commits. Secrets are removed before anything is sent, and every question and proposal is audited. Off until you switch it on.
Add-on module
Korthveil Central management
Outbound-only agent for fleet management by Korthveil Central: one-time-token enrollment to a device certificate, mTLS 1.3 heartbeat with health and inventory, and a fixed allowlist of commands (status, fetch and apply a configuration revision through the commit pipeline, reboot request). No shell.
Add-on module
SentinelOps RMM
Appliance-mode SentinelOps RMM agent: sends inventory, telemetry, and alert events over an outbound TLS 1.3 channel and accepts only a fixed catalog of typed actions. No shell, scripts, packages, or file access. Needs a SentinelOps account; the agent API is not yet verified against SentinelOps.
Included in Core
UPS & power
Watches the UPS (USB, SNMP card, or another NUT server) with Network UPS Tools and shuts down gracefully when the power fails and the battery cannot last: NUT clients on other machines, mapped machines over SSH in waves, then the firewall itself; the UPS cuts and restores its output so everything comes back with mains. A failover pair's standby shuts down early to save its battery.
Add-on module