Pre-order
Three sizes and two high-availability pairs, from €749 ex VAT. Shipped with OpenBSD 7.9 and OgmaProtect installed, burn-in tested, and our signing key already in place — in the edition you choose. Pick by what your connection actually needs; first units are on pre-order.
The software is free for a qualifying small business and runs on any amd64 hardware OpenBSD supports. The appliance is for the things a download cannot do for you.
Our signing key is installed and hash-checked before the unit ships — the one step people get wrong is already done, and you verify it with two commands, printed on the sheet in the box. No product credential is created at the factory: your admin password, certificate and keys are generated on your first boot, on the unit.
OpenBSD 7.9 and the current signed OgmaProtect release, in the edition you choose, burn-in tested. Nothing about it is proprietary lock-in: it is the same software as the free edition, on hardware we have already run in.
A serial recovery cable ships with every unit, the recovery runbooks are installed on it, and a 12-month hardware warranty covers the metal. Fanless, so it sits in a cupboard for years without a moving part to fail.
Three throughput classes and two HA pairs. Tell us the uplink, the site count and roughly how much VPN you terminate, and we will say which unit fits — including when the smaller one is the right answer.
Every appliance is available in either edition. The software is the same, the licence is the same, and the signing key is anchored at the bench either way.
A conventional OpenBSD install with OgmaProtect installed the way a customer would: a
writable disk, updates by the same two-step stage and apply as the free edition, and
OpenBSD errata by syspatch. What the factory bench builds today.
A signed, read-only operating system on two boot slots, with your configuration on its own partition. Updates are whole signed images onto the standby slot, and OpenBSD errata arrive the same way. Built and signed with the current release, being proven on real hardware now — offered as soon as it is.
Both root slots are read-only. Nothing a compromised process writes to the root
survives a reboot; the system tree is rebuilt from the active slot every boot. Your
configuration, revisions, users and keys live on /cfg and are never part
of the image.
An update is a whole new signed image, streamed onto the standby slot and verified against the release manifest before it is activated — behind two confirmations. A boot that fails three times is designed to switch the unit back to the previous slot on its own: proven in tests, not yet on shipped hardware.
Logs live in RAM on this edition, so remote syslog is required — the product says so. The kernel and library link order are randomised per image release rather than per boot, because a read-only root cannot re-link itself; every per-process mitigation is unaffected. Root's password is locked; the serial console is the recovery floor.
Prices are per appliance, ex VAT, and include the software pre-installed and a 12-month hardware warranty.
€749 ex VAT
For small businesses and branches on broadband up to 1 Gbps.
| Processor | Intel J6412 quad-core with AES-NI |
|---|---|
| Network | 4 × 2.5GbE |
| Memory | 8 GB RAM (expandable to 32 GB) |
| Storage | 240 GB SSD |
| Chassis | Fanless, 12 V supply, serial console |
| Throughput | Up to 1 Gbps WAN |
| VPN | Around 300–600 Mbps encrypted VPN |
| Sized for | 25–75 users |
Best for: Ordinary fibre connections, small offices, pharmacies, retail sites and remote branches.
€1,099 ex VAT
For multi-WAN, VLAN-heavy networks and broadband up to 2.5 Gbps.
| Processor | Intel i3-10110U with AES-NI |
|---|---|
| Network | 6 × 2.5GbE |
| Memory | 8 GB RAM (16 GB option, up to 64 GB) |
| Storage | 240 GB SSD, NVMe capable |
| Chassis | Fanless, optional TPM, serial console |
| Throughput | 1–2.5 Gbps WAN |
| VPN | Around 700 Mbps–1.5 Gbps encrypted VPN |
| Sized for | 75–250 users |
Best for: Sites that need real interface count: primary fibre, 5G failover, a secure LAN, a CCTV VLAN or dedicated port, a guest network, and a management or HA interface of its own.
€2,199 ex VAT
For headquarters, 10GbE connectivity and heavy VPN concentration.
| Processor | Intel i5-1235U with AES-NI (i7-1255U option) |
|---|---|
| Network | 4 × 2.5GbE plus 2 × 10GbE SFP+ |
| Memory | 16 GB DDR5 |
| Storage | 500 GB NVMe |
| Chassis | Fanless, serial console |
| Throughput | Multi-gigabit edge |
| VPN | Around 2–4 Gbps encrypted VPN |
| Sized for | 250–750 users |
Best for: Headquarters, multi-gigabit fibre and sites terminating a lot of site-to-site or remote-access VPN.
Throughput, VPN and user figures are indicative sizing targets, not benchmark guarantees — real numbers depend on your rule set, tunnel count and traffic mix. Tell us what you run and we will size it with you rather than sell you the bigger box by reflex.
Two matched appliances you join as a CARP and pfsync pair at first boot — we walk you through it — so a unit can fail without dropping established connections. Priced as a bundle, cheaper than two units bought separately.
€1,999 ex VAT for the pair
Two Branch 2.5G appliances sold as a CARP and pfsync pair, joined at first boot.
Best for: Resilient business deployments where an hour of downtime costs more than the second box.
Two × Branch 2.5G — €2,198 bought singly, so the pair saves €199.
€3,999 ex VAT for the pair
Two Core 10G appliances sold as a CARP and pfsync pair, joined at first boot.
Best for: Data centres, large offices and headquarters that cannot take a maintenance window.
Two × Core 10G — €4,398 bought singly, so the pair saves €399.
Changes that could cut you off revert unless you confirm them — CARP included, so a failover configuration that would strand you undoes itself. See how.
Every unit ships with OpenBSD 7.9 and OgmaProtect installed and burn-in tested — the same platform this site describes, ready at first boot.
Appliances take the same signed releases as the software edition; the signing key is pre-installed. In progress
Appliance or your own hardware, it is the same software and the same management plane, and the licence is the same. A qualifying small business runs it free on either.
Uplink speed, how many sites, roughly how much VPN you terminate — and we will say which unit fits, including when the smaller one is the right answer.
Prices are ex VAT and exclude delivery. Licensing is separate from hardware and unchanged by it — see pricing & licensing. Prefer to build your own? OgmaProtect runs on any amd64 hardware OpenBSD 7.9 supports — bring your own box.