Sovereign Edge Firewall

Sovereign Edge Firewall is a custom network security architecture with dual-provider high availability, segmented security zones, and full auditability. Open-source based, license-free, no vendor lock-in — in active production.

  flowchart LR
    A[Internet] --> B[Provider A]
    A --> C[Provider B]
    B --> D{"HA state manager"}
    C --> D
    D --> E[Active firewall]
    E --> F[Transparent proxy<br/>SSL-offloading]
    F --> G[Internal network]

What it is

Conventional vendor firewalls (Fortinet, Cisco, Palo Alto, SonicWall & co.) mean recurring license fees, telemetry flowing back to the vendor’s cloud, and a configuration model nobody fully understands except the vendor. If a specialized requirement isn’t on the vendor’s roadmap, it simply doesn’t exist — or only via expensive custom-engineering contracts.

The Sovereign Edge Firewall replaces that stack with an auditable open-source solution that does exactly what’s needed — and nothing more. Every rule is visible, every design decision traceable, every data flow documented.

Dual-provider high availability

Two independent internet uplinks (e.g. fiber + LTE/5G or two different carriers) are connected in parallel. A monitoring service continuously watches each uplink’s health and switches to the secondary in under five seconds when the primary fails.

• 🔁 Automatic failover — Link state, gateway reachability, and latency are continuously monitored. Outage → switchover in under five seconds.
• 🛣️ Symmetric treatment — Both providers operate under the same rules. No “good path” and “bad path.”
• 🎯 Selective routing — Specific services or customer groups can be routed deliberately through the secondary provider (load balancing, anonymized egress).
• 🚨 Automatic failback — Once the primary uplink is healthy again, traffic flows back automatically.
• 💼 Business continuity — A carrier outage is not a business outage. Customer contact, orders, and internal tools stay reachable.

Zone segmentation

Instead of a flat “inside/outside” topology, the firewall operates on a multi-tier zone model. Each zone has its own security and egress profile; lateral movement between zones is blocked by default.

• 🟢 Client zone — Employee workstations with content inspection and caching.
• 🟡 VPN zone — Remote access and site-to-site tunnels with their own egress profile.
• 🟣 Anonymization zone — Protected path for sensitive activities (research, whistleblower channels).
• 🔷 Privacy zone — Additional anonymization tier for very sensitive workloads.
• 🔴 DMZ — Externally reachable services behind a hardened reverse proxy.

Zone separation is a central security asset compared to vendor firewalls, which typically support only a basic LAN/DMZ split.

Transparent security layers

The firewall integrates several security and privacy mechanisms directly at the network level — endpoints benefit without any local configuration.

• 🛡️ SSL offloading as malware protection — Encrypted web traffic (HTTPS) is terminated at the gateway, the cleartext content is scanned by a virus scanner, and only then forwarded to the endpoint. Over 90 % of today’s web threats hide behind TLS — without this layer, classic endpoint antivirus is blind to encrypted malware downloads, phishing payloads, and drive-by exploits.
• 🌐 HTTP inspection — Content checking and caching for unencrypted web traffic too.
• 🚫 Content filter — Ads, trackers, and known malicious domains are filtered out before delivery.
• 🧅 Anonymization layer — Entire zones can be routed transparently through the Tor network — including DNS queries.
• 🔷 Privacy layer — Second anonymization tier for maximum protection of sensitive workloads.
• 🌍 Selective geo-routing egress — Traffic classes can be routed deliberately through specific geographical exit points.

CEO view on SSL offloading: Endpoint antivirus (Defender, Bitdefender, …) without gateway SSL termination sees only the encrypted stream — it can detect infected files only after they are unpacked on the device, which is already too late. With SSL offloading at the edge, malware is blocked before it ever reaches the endpoint.

Operational security mechanisms

• 🛑 Default deny — Everything not explicitly allowed is blocked. Spoofing protection, reverse-path validation, anti-scan heuristics.
• 🚪 Automatic brute-force defense — Repeatedly suspicious source IPs are automatically promoted into a persistent blocklist and dropped immediately.
• ⚡ Rate limiting — Per-source hard limits on parallel connections and connect rate. Exceeding it → automatic blocking.
• 🚫 Multi-tier blocklists — Custom blocklists, spammer lists, and dynamically populated attacker tables are persisted and reloaded on restart automatically.
• 🧊 Traffic normalization — TCP reassembly, MSS clamping, and fingerprinting protection — especially relevant for mobile uplinks (5G) and VPN tunnels.
• 🌐 Full IPv4 + IPv6 — Dual stack out of the box, including modern ICMPv6 mechanics.
• 📈 High connection-state capacity — Hundreds of thousands of parallel sessions, no limit bottlenecks even under load.

Why this matters at the CEO level

• 💰 License cost = €0 — No subscription, no annual maintenance with built-in price escalation, no license audits. One-time hardware investment, ongoing cost close to zero.
• 🛡️ Sovereignty — Full control over ruleset and data flows. No vendor cloud, no phone home, no hidden telemetry channels. Important for compliance, competitive defense, and political resilience.
• 📊 Auditability — The entire ruleset fits in a single file with ~380 commented lines. By comparison, vendor firewalls are multi-thousand-line XML configurations with undocumented default logic, whose actual behavior only the vendor truly knows.
• 🔧 Adaptability — Specialized requirements (custom zone models, anonymization layers, per-service egress) are either not even representable in the vendor world, or only via expensive custom-engineering contracts — here they are routine.
• ♻️ Longevity — No end-of-sale dates, no forced hardware swap after five years, no major upgrades that risk operations. The system runs as long as the hardware lives.
• 🧪 Disaster recovery in minutes — Complete configuration in version control. On hardware failure: load a new box, apply the configuration, done — in under 30 minutes.

Technology foundation

Built on open-source components (BSD or Linux possible) — all elements are part of established, long-maintained projects. Specific tool choices intentionally kept out of CEO-level material — the architecture is platform-portable.

Sovereign Edge Firewall — custom firewall · dual-provider HA · 5+ security zones · license-free · in production