OgmaProtect turns a stock OpenBSD box — or one of our fanless appliances — into a firewall that fails closed, verifies what it installs, and can prove what it did.
Early access · v0.5.5 · OpenBSD 7.9 Source available to auditors on request No telemetry
Free for qualifying small businesses
pkg_add — any amd64 hardware OpenBSD supports.From €749 ex VAT · pre-order
ogmaprotectctl, with a manual page — and drift detection that flags your hand edits as exactly that.OpenBSD's habits — pledge and unveil, fail closed, verify everything — as the shape of the product, not a layer under it.
Firewall, routing, DNS, DHCP, VPN — every domain is its own daemon, pledged and unveiled to the minimum it needs. The web tier renders pages and holds nothing worth stealing.
Every apply is validated, written atomically and recorded as a revision. Changes that could cut you off revert unless you confirm them. Drift is flagged within minutes, not at the next audit.
Releases are signed offline and refused if they are not. The audit trail carries integrity tags an auditor can check off the box. Every claim on this site maps to evidence in the source tree.
The signing key exists only on offline media, held by two custodians. CI builds drafts; an air-gapped machine signs. CI holds no key: a compromised build runner cannot sign or publish a release on its own.
A DNS record on a separate domain at a separate provider, with its fingerprint printed on the download page to compare against.
Everything a release ships — the package and, when a release carries one, the appliance image — under a single signature. pkg_add refuses anything unsigned.
A published security policy: acknowledgement within three working days, coordinated disclosure, and advisories that say what is affected and what to do.
Everything below goes through the same pipeline: validate, apply live, write atomically, record a revision — with drift detection watching the result.
Structured rules, inline NAT, tables, a live state browser, brute-force auto-ban, anti-lockout built in.
OSPF and BGP with a real policy engine, peer groups, TCP-MD5, zero-downtime key rotation, a route-leak gate.
WireGuard with a full key lifecycle, IPsec (IKEv2 and manual), GRE, VXLAN, EtherIP and gif.
Multi-WAN failover on real health probes, PPPoE, IPv6 end to end, VLANs and bridges.
DHCP with live leases, DNS with DNS-over-TLS and DNSSEC, block-lists, managed NTP.
CARP with safe preemption windows, pfsync, authenticated configuration sync.
Users, roles and MFA, a tamper-evident audit trail, two-step updates, alerting, diagnostics.
Signed, optionally encrypted bundles, dry-run import, a rehearsed console-only restore.
Edge 1G, Branch 2.5G, Core 10G and two HA pairs, sized with you rather than up. Every one comes in the edition you choose: the software edition, or the image edition — a signed, read-only operating system on two boot slots, with your configuration on its own partition.
In progress The image edition — built and signed with the current release, being proven on hardware now, and offered on every appliance as soon as it is.
The full platform, free to use for the benefit of a company with fewer than 100 people and under USD 1M (2019, inflation-adjusted) revenue in the prior tax year — both conditions must hold.
The same product for organisations beyond the small-business threshold, licensed directly by Wireless Connect Ltd. — with commercial terms, support expectations and distribution rights agreed to fit.
Pre-installed, burn-in tested hardware in three sizes from €749 ex VAT, plus HA pairs. Hardware is priced separately and does not change the licence.
In design, shown for roadmap transparency: curated threat-feed subscriptions and external-vantage exposure scanning that verifies your firewall from the outside. Not yet available.
Licensed under the PolyForm Small Business License 1.0.0 — source-available, not open source; copies may be passed on, the right to use them may not. The product is v0.5.5, in early access, and the roadmap says what is real without inventing a date. Details on the pricing & licensing page.
Download the signed package and have a managed firewall before the day is out — or pre-order an appliance and plug it in. Auditor waiting? Send us the questionnaire.