OpenBSD foundation. Live threat intelligence.

Firewall protection.
Live intelligence.

Combine OpenBSD firewalling with live IP threat intelligence. Block connections to known malicious destinations and bring serious outbound activity to your attention.

Download OgmaProtect Get deployment support

Install on OpenBSD 7.9 · Threat feed available as a premium add-on

Threat intelligence. Applied at your firewall. Interface concept
OgmaProtectExample workspace
Choose an illustrative product viewOgmaProtectMAIN OFFICE
MCAdministratorLocal management
WORKSPACE / PROTECTION

Threat feeds

Example

Intelligence delivered to this firewall.

OgmaControl Enabled

Premium IP threat feed

Feed content
IP addresses & ranges
Update interval
Regular updates
Delivery
Signed block list
Firewall action
Block matching IPs

Intelligence from OgmaPot and other sources.
Filtering happens on your firewall.

See how the feed works
WORKSPACE / OVERVIEW

Your network

Online

A view of your connections and network zones.

Primary connectionOffice internet
Connected
NETWORKSTATUS

Office networkStaff & business devices

Active

Guest networkSeparate visitor access

Active

Remote accessBranch VPN

Connected
Latest configuration savedExplore features ↗
WORKSPACE / FIREWALL

Access rules

Example

Understand which connections are allowed.

ALLOW
Staff → InternetOffice network · Outbound access
ALLOW
Guests → InternetGuest network · Outbound access
BLOCK
Guests → OfficeKeep visitor traffic separate
ALLOW
Branch → OfficeSelected services over VPN

Illustrative rules for a sample office network.

WORKSPACE / HISTORY

Change history

Example

See what changed and who changed it.

Guest access updatedAdministrator · Today, 10:42Applied and confirmed

Branch VPN configuredAdministrator · Yesterday, 15:18Applied and confirmed

Office network createdAdministrator · Monday, 09:06Applied and confirmed

Illustrative interface · sample dataTry the four views above
OpenBSD foundationLive IP threat feedClear web interfaceHow the feed works

Live threat intelligence Premium add-on

Known hostile IPs.
Blocked at your firewall.

Add a regularly refreshed IP block list to your OpenBSD firewall. Intelligence from OgmaPot and other sources is brought together by OgmaControl and delivered to OgmaProtect. Use it to filter incoming threats and spot devices trying to reach known malicious destinations.

Buy threat feed Pricing & details

€450 per firewall per year, excluding VAT.
For business customers. One activation key per firewall.

Intelligence into action
01

Regularly refreshed.Fresh intelligence delivered to your box.

02

Delivered as a signed feed.An IP block list sent to your box.

03

Enforced at the firewall.Block traffic matching listed addresses.

An additional layer of defence alongside your firewall rules.

The Ogma ecosystem at work.

Follow the intelligence

Explore the illustrative ecosystem journey

Observe. Coordinate. Protect.

An illustrative journey from hostile activity to local protection.

01 / OBSERVE

OgmaPot

A network of honeypots observes hostile activity.

SensorSensorSensor
02 / COORDINATE

OgmaControl

Aggregate intelligence, manage the IP feed and distribute updates.

Other intelligence sources
03 / PROTECT

OgmaProtect

Apply the feed on each firewall and block matching traffic.

OfficeBranchCustomer
Matching traffic blocked locally Serious outbound event flagged
ILLUSTRATIVE EXAMPLE203.0.113.42Documentation address

A honeypot observes hostile activity.

An OgmaPot sensor sees attack traffic from the example IP address and contributes the observation to the intelligence pipeline.

OgmaControl manages the intelligence.

The observation is considered alongside other intelligence sources. In this example, the address is selected for inclusion in the managed feed.

A signed update reaches the firewalls.

Subscribed OgmaProtect firewalls receive and verify the signed IP feed before using it for local enforcement.

A device tries to contact the listed IP.

An office workstation attempts an outbound connection. OgmaProtect blocks the matching traffic where feed blocking is enabled.

An outbound warning reaches your team.

The outbound hit raises an alert. With email or a webhook configured, the team can investigate the device. A match does not confirm infection.

Select any stage to stop the animation. Illustrative sequence, not a live feed. Inclusion depends on feed management; blocking depends on your firewall policy. Firewall hit records are not sent back to the feed service.

The feed is an optional premium subscription. Protection depends on the feed content, successful updates and your firewall policy.

Outbound protection & early warning

A blocked connection.
A warning worth seeing.

When a device on your network tries to contact a known malicious IP, it can be a sign that something is wrong.

OgmaProtect can identify the connection, block it and alert you to serious outbound activity, so you know which device needs attention.

  1. 01

    Identify the device.

    See where the connection came from and which destination it tried to reach.

  2. 02

    Interrupt the connection.

    Apply your policy to block traffic matching the threat feed, or raise an alert for investigation.

  3. 03

    Focus on serious events.

    Outbound feed hits raise alerts; routine inbound hits do not. Repeated outbound events are grouped to reduce noise.

A chance to catch warning signs early.

Contact with known malicious infrastructure can reveal activity associated with malware or some ransomware attacks. An early alert gives your team a chance to investigate before the incident escalates.

EXAMPLE SECURITY EVENTIllustrative alert
OgmaProtectInvestigate

Suspicious outbound connection

An office device tried to reach an IP listed in the threat feed.

Office workstation192.168.10.24
Feed-listed destination203.0.113.42
Event time
10:42 · sample event
Direction
Outbound · from your network
Why it matters
Destination listed for malicious activity
Action
Connection blocked by feed policyConnection logged by feed policy
Notification
Local log; configured email or webhook
Explore the policy example
Illustrative response policy
Connection blocked. Investigation needed.

The matching connection is stopped, and the device is flagged for review. Blocking this connection does not establish that the device is clean.

Connection logged. Investigation needed.

This feed category logs the attempt and raises an outbound alert. It does not block the connection; other firewall rules still apply.

What makes this alert useful?

A clear alert identifies the source device, destination, feed match, event time and firewall action. Outbound events are grouped to reduce repeated notifications. Alerts go to the local system log by default; configure email or a webhook to reach your team.

The next step is to check the device and its endpoint security records. An IP match alone does not confirm ransomware.

Illustrative alert with sample data. Email or webhook notification requires a configured channel. The destination is a documentation address; no notification is sent by this example.

Detection covers matching traffic that passes through the firewall. Use it alongside endpoint protection, patching and tested backups.

See where the intelligence comes from

Made for the everyday

Less time finding your way.
More control over your network.

From your first firewall rule to everyday changes, keep the work in one clear interface.

Decide what gets through.

Manage access to your network with rules you can review and understand.

See access rules

Give every network its place.

Keep business devices, guest access and remote connections clearly organised.

Explore the network view

Keep track of your changes.

See your configuration history and understand what has changed over time.

View change history

Start with the software

Your hardware.
Your next firewall.

Install OgmaProtect on a supported OpenBSD 7.9 amd64 system, then manage your network from your browser.

Free for qualifying small businesses.
Check licensing eligibility ↗
Download OgmaProtect
01

Check your system.

Review the supported hardware, OpenBSD version and licence before you begin.

02

Install the software.

Follow the download, verification and installation guide.

03

Take control.

Sign in through your browser and configure your network.

Read the installation guide

A route that suits you

A little help. Or a ready-built box.

Start independently, or talk to us about the right way to deploy.

02 / SUPPORTED DEPLOYMENT

Bring us your requirements.

Talk through your network, installation and support needs with the OgmaProtect team.

Get deployment support
03 / APPLIANCES

Prefer a dedicated appliance?

Explore hardware options and discuss the right fit for your network. Appliances are available for pre-order.

Explore appliances

Security in the foundations

Clear on the surface.
Considered underneath.

OpenBSD provides the firewall foundation. The optional threat feed adds regularly refreshed intelligence, with filtering carried out on your own box.

Read about the architecture
01

Control access.

Administrator roles and multi-factor authentication.

02

Verify your software.

Signed releases and a documented verification process.

03

Understand the detail.

Security documentation and published release information.

Your next step

Start with OgmaProtect.

Download the software Need a hand? Talk to us