OgmaProtect is a secure web management plane for OpenBSD routers and firewalls. Every domain runs in its own sandboxed daemon, every change is validated and reversible, and every action leaves an audit trail. Free for qualifying small businesses.
Source-available · no phone-home · your configuration never leaves your router
16 daemons. One responsibility each. That is the whole design.
A firewall is the one machine where a bad change locks you out and a quiet failure exposes everything behind it. OgmaProtect is designed around that reality.
The web tier can never touch your configuration directly. Each domain — firewall, routing, DNS, DHCP, VPN — is its own OpenBSD-sandboxed daemon (pledge and unveil), reachable only through authenticated, role-checked control sockets.
Every apply is validated first, written atomically, and recorded as a revision you can roll back. Risky changes run in commit-confirmed windows that revert automatically if you lose access — and drift detection tells you when live state stops matching intent.
Before commercial launch, the entire codebase went through an eight-lens structural audit — architecture, security, state and recovery, tests, supportability and more. The findings drive the hardening programme we are shipping right now, in the open with our early-access users.
Everything below is configured through the same model: validate, apply live, write atomically, record a revision — with per-domain drift detection watching the result.
Structured rules with inline NAT, tables, macros and traffic policing; a live state browser with surgical state kill; brute-force auto-ban; anti-lockout and default-deny baselines built in.
OSPF and BGP with depth few GUIs expose: a full BGP policy engine, peer groups and templates, per-neighbor tuning, TCP-MD5, zero-downtime OSPF key rotation — with a route-leak safety gate.
WireGuard with a complete key lifecycle, IPsec (IKEv2 and manual keying), and GRE, VXLAN, EtherIP and gif tunnels — all with drift detection and reversible applies.
Multi-WAN failover driven by real gateway health probes, PPPoE WAN, IPv6 WAN and LAN (SLAAC, DHCPv6-PD, router advertisements), VLANs and bridges.
DHCP server with live leases and one-click static reservations; DNS with DNS-over-TLS upstreams, DNSSEC, local zones and block-lists; managed NTP.
CARP virtual IPs with safe preemption windows, pfsync state synchronisation, and authenticated cross-peer configuration sync for active/backup pairs.
Users, roles and TOTP MFA with hard anti-lockout; configuration revisions with rollback; alerting to TLS syslog and webhooks; capture, sweep and reachability diagnostics.
Full-configuration export with validated dry-run import and revision history. Backup signing and encryption are landing in the current hardening programme.
The source is available to auditors and licensees on request. Security reports: hello@ogmaprotect.com. The full security story →
A range of hardware appliances — multiple sizes and throughput classes, shipped with OgmaProtect pre-installed, configured and tested. Unbox, connect, and manage from the same interface. The lineup will be announced here.
The full platform, free to use for the benefit of a company with fewer than 100 people and under USD 1M (2019, inflation-adjusted) revenue in the prior tax year — both conditions must hold.
The same product for organisations beyond the small-business threshold, licensed directly by Wireless Connect Ltd. — with the commercial terms, support expectations and distribution rights agreed to fit.
In design, shown here for roadmap transparency: curated IP and DNS threat-feed subscriptions with block reporting, and external-vantage exposure scanning that verifies your firewall from the outside. Not yet available.
Pre-installed, pre-tested OgmaProtect hardware in a range of sizes and throughput classes. Register interest.
OgmaProtect is licensed under the PolyForm Small Business License 1.0.0 — source-available, not open source; redistribution requires a separate agreement. Details on the pricing & licensing page.
OgmaProtect is in early access (v0.5.0) while the pre-1.0 hardening programme completes. Access is granted per request — you get the real package, the quickstart, and a direct line to the people building it.
pkg_add-able package and quickstart under the license terms — installs
on a stock OpenBSD 7.x system. Full walkthrough on the
Get started page.
Requirements: OpenBSD 7.x on the router, a browser on your side. No cloud account, no telemetry, no external dependencies.