Edge 1G
Pre-order€749 ex VAT
For small businesses and branches on broadband up to 1 Gbps.
4 × 2.5GbE
OgmaProtect appliances
Your network.
The right firewall.
Choose a dedicated OgmaProtect appliance for your office, branch or larger network. Compare the range below, from €749 ex VAT.
Available to pre-order. Confirm delivery and deployment requirements with our team.
Branch 2.5G
Pre-order€1,099 ex VAT
For multi-WAN, VLAN-heavy networks and broadband up to 2.5 Gbps.
6 × 2.5GbE
Core 10G
Pre-order€2,199 ex VAT
For headquarters, 10GbE connectivity and heavy VPN concentration.
4 × 2.5GbE plus 2 × 10GbE SFP+
Prices are per appliance, ex VAT, excluding delivery. Includes pre-installed software and a 12-month hardware warranty. Licensing is separate.
Need resilience? Explore HA pairs →Pre-order opens a draft in your email app with the selected model filled in. You can also email hello@ogmaprotect.com.
Images illustrate the chassis; final faceplate branding may vary. Capacity figures are indicative sizing targets, not benchmark guarantees.
Compare the specifications.
Prices are per appliance, ex VAT, and include the software pre-installed and a 12-month hardware warranty.
OgmaProtect Edge 1G
Pre-order€749 ex VAT
For small businesses and branches on broadband up to 1 Gbps.
| Processor | Intel J6412 quad-core with AES-NI |
|---|---|
| Network | 4 × 2.5GbE |
| Memory | 8 GB RAM (expandable to 32 GB) |
| Storage | 240 GB SSD |
| Chassis | Fanless, 12 V supply, serial console |
| Throughput | Up to 1 Gbps WAN |
| VPN | Around 300–600 Mbps encrypted VPN |
| Sized for | 25–75 users |
Best for: Ordinary fibre connections, small offices, pharmacies, retail sites and remote branches.
OgmaProtect Branch 2.5G
Pre-order€1,099 ex VAT
For multi-WAN, VLAN-heavy networks and broadband up to 2.5 Gbps.
| Processor | Intel i3-10110U with AES-NI |
|---|---|
| Network | 6 × 2.5GbE |
| Memory | 8 GB RAM (16 GB option, up to 64 GB) |
| Storage | 240 GB SSD, NVMe capable |
| Chassis | Fanless, optional TPM, serial console |
| Throughput | 1–2.5 Gbps WAN |
| VPN | Around 700 Mbps–1.5 Gbps encrypted VPN |
| Sized for | 75–250 users |
Best for: Sites that need real interface count: primary fibre, 5G failover, a secure LAN, a CCTV VLAN or dedicated port, a guest network, and a management or HA interface of its own.
OgmaProtect Core 10G
Pre-order€2,199 ex VAT
For headquarters, 10GbE connectivity and heavy VPN concentration.
| Processor | Intel i5-1235U with AES-NI (i7-1255U option) |
|---|---|
| Network | 4 × 2.5GbE plus 2 × 10GbE SFP+ |
| Memory | 16 GB DDR5 |
| Storage | 500 GB NVMe |
| Chassis | Fanless, serial console |
| Throughput | Multi-gigabit edge |
| VPN | Around 2–4 Gbps encrypted VPN |
| Sized for | 250–750 users |
Best for: Headquarters, multi-gigabit fibre and sites terminating a lot of site-to-site or remote-access VPN.
Throughput, VPN and user figures are indicative sizing targets, not benchmark guarantees — real numbers depend on your rule set, tunnel count and traffic mix. Tell us what you run and we will size it with you rather than sell you the bigger box by reflex.
High-availability pairs
Two matched appliances you join as a CARP and pfsync pair at first boot — we walk you through it — so a unit can fail without dropping established connections. Priced as a bundle, cheaper than two units bought separately.
OgmaProtect Branch HA
€1,999 ex VAT for the pair
Two Branch 2.5G appliances sold as a CARP and pfsync pair, joined at first boot.
Best for: Resilient business deployments where an hour of downtime costs more than the second box.
Two × Branch 2.5G — €2,198 bought singly, so the pair saves €199.
OgmaProtect Core HA
€3,999 ex VAT for the pair
Two Core 10G appliances sold as a CARP and pfsync pair, joined at first boot.
Best for: Data centres, large offices and headquarters that cannot take a maintenance window.
Two × Core 10G — €4,398 bought singly, so the pair saves €399.
Changes that could cut you off revert unless you confirm them — CARP included, so a failover configuration that would strand you undoes itself. See how.
What every appliance includes
- OpenBSD and OgmaProtect pre-installed and burn-in tested
- Branded faceplate
- Serial recovery cable
- 12-month hardware warranty
Pre-installed and tested
Every unit ships with OpenBSD 7.9 and OgmaProtect installed and burn-in tested — the same platform this site describes, ready at first boot.
Appliances take the same signed releases as the software edition; the signing key is pre-installed. In progress
One product, either way
Appliance or your own hardware, it is the same software and the same management plane, and the licence is the same. A qualifying small business runs it free on either.
Pre-order
Prepared for your network.
The software is free for a qualifying small business and runs on any amd64 hardware OpenBSD supports. The appliance is for the things a download cannot do for you.
Anchored at the bench
Our signing key is installed and hash-checked before the unit ships — the one step people get wrong is already done, and you verify it with two commands, printed on the sheet in the box. No product credential is created at the factory: your admin password, certificate and keys are generated on your first boot, on the unit.
Installed, tested, and the same product
OpenBSD 7.9 and the current signed OgmaProtect release, in the edition you choose, burn-in tested. Nothing about it is proprietary lock-in: it is the same software as the free edition, on hardware we have already run in.
The console is in the box
A serial recovery cable ships with every unit, the recovery runbooks are installed on it, and a 12-month hardware warranty covers the metal. Fanless, so it sits in a cupboard for years without a moving part to fail.
Sized with you, not up
Three throughput classes and two HA pairs. Tell us the uplink, the site count and roughly how much VPN you terminate, and we will say which unit fits — including when the smaller one is the right answer.
The engineering behind your appliance.
Choose the available software edition when ordering. The image edition is shown below with its current availability. Both use the same OgmaProtect software and licensing.
Software edition
A conventional OpenBSD install with OgmaProtect installed the way a customer would: a
writable disk, updates by the same two-step stage and apply as the free edition, and
OpenBSD errata by syspatch. What the factory bench builds today.
Image edition
A signed, read-only operating system on two boot slots, with your configuration on its own partition. Updates are whole signed images onto the standby slot, and OpenBSD errata arrive the same way. Built and signed with the current release, being proven on real hardware now — offered as soon as it is.
How the image edition boots
Slot A · active Read-only root The release you are running. Nothing written here survives a reboot.
Slot B · standby Read-only root The next signed image lands here, is verified, then activated.
/cfg · writable Your configuration and state Untouched by updates. The only partition your data lives on.
RAM /etc · /var · /dev Rebuilt from the active slot at every boot.
Read-only, twice over
Both root slots are read-only. Nothing a compromised process writes to the root
survives a reboot; the system tree is rebuilt from the active slot every boot. Your
configuration, revisions, users and keys live on /cfg and are never part
of the image.
Updates that cannot half-apply
An update is a whole new signed image, streamed onto the standby slot and verified against the release manifest before it is activated — behind two confirmations. A boot that fails three times is designed to switch the unit back to the previous slot on its own: proven in tests, not yet on shipped hardware.
The trade-offs, stated
Logs live in RAM on this edition, so remote syslog is required — the product says so. The kernel and library link order are randomised per image release rather than per boot, because a read-only root cannot re-link itself; every per-process mitigation is unaffected. Root's password is locked; the serial console is the recovery floor.
Pre-order
Tell us your uplink and we will tell you which one.
Uplink speed, how many sites, roughly how much VPN you terminate — and we will say which unit fits, including when the smaller one is the right answer.
Prices are ex VAT and exclude delivery. Licensing is separate from hardware and unchanged by it — see pricing & licensing. Prefer to build your own? OgmaProtect runs on any amd64 hardware OpenBSD 7.9 supports — bring your own box.