SinonFirewall is a self-hosted next-generation firewall that compiles your policy in a database and deploys it atomically to the Linux kernel: stateful filtering and NAT, Suricata IDS/IPS, application identification, TLS inspection, four VPN types, SD-WAN, routing, DNS/DHCP, and more, from one control plane.
Self-host or SinonTech-hosted. Dry-run, deploy, rollback. Air-gap capable.
Control Plane, L3–L7
Firewall, NAT, IDS/IPS, app-ID, URL and TLS inspection, VPN, SD-WAN, routing, DNS/DHCP, WiFi and VoIP, all in one place.
VPN Types
WireGuard, IPsec/IKEv2, OpenVPN, and an SSL-VPN portal, each rendered to real daemon config.
Schema Migrations
The policy database is the source of truth, compiled to nftables and deployed in a single atomic transaction.
API Modules
REST API spanning firewall, NAT, VPN, IDS, routing, DNS/DHCP, WiFi, VoIP, HA, telemetry and more.
Deployment Modes
Bare metal, Docker, Kubernetes, cloud VMs, virtual environments, and fully air-gapped.
SinonFirewall is not a packet filter with extras bolted on. Each capability has its own database schema, service, config renderer and deploy worker. Every one drives a real Linux datapath component, not a simulation.
nftables-based stateful filtering with six rule actions and seven NAT types: SNAT, DNAT, one-to-one, hairpin, port forwarding, redirect and masquerade.
Suricata intrusion detection and prevention with live event consumption, plus nDPI application identification and deep packet inspection.
URL filtering with category lists, and TLS inspection via a managed man-in-the-middle CA for visibility into encrypted traffic.
WireGuard, IPsec/IKEv2 (strongSwan), OpenVPN and an SSL-VPN portal, all configured from the same control plane.
Multi-WAN with SD-WAN path policies and probes, plus dynamic routing (BGP and OSPF via FRR) for real network topologies.
Recursive DNS (Unbound), DHCP (Kea), traffic shaping, a WiFi controller (hostapd/CAPWAP), a VoIP session border controller, and a captive portal.
The riskiest moment with any firewall is applying a change. SinonFirewall makes that safe by treating configuration as code with a real deploy pipeline.
Policy compiles from the database to a full nftables ruleset, loads in a single atomic transaction, and rolls back cleanly if it fails, leaving no half-applied state on your edge.
Manage firewall configuration from Git, so changes are reviewed, versioned and auditable like any other code.
Active/standby failover with keepalived and connection-tracking sync via conntrackd, so a failover does not drop live sessions.
Read-only visibility into OPNsense, Cisco, Fortinet, Palo Alto, Juniper, MikroTik and more. Pull their config and detect drift while you migrate.
Hash-chained audit logging of every change, with per-tenant envelope-encrypted secrets.
An optional AI assistant with pluggable providers (Anthropic, OpenAI, Gemini, Ollama or llama.cpp), so you can keep inference local.
| Filtering | Stateful nftables filtering; 6 rule actions (allow, block, reject, log, nat, redirect); 7 NAT types; alias groups (IP range, ASN, MAC, domain) |
|---|---|
| Threat prevention | Suricata IDS/IPS with live event consumption, nDPI application identification and DPI, threat-intelligence feeds |
| Content control | URL filtering, TLS inspection via managed MITM CA |
| VPN | WireGuard, IPsec/IKEv2 (strongSwan), OpenVPN, SSL-VPN portal |
| Routing & WAN | Multi-WAN, SD-WAN path policies and probes, BGP and OSPF (FRR) |
| Network services | DNS (Unbound), DHCP (Kea), traffic shaping (tc), WiFi controller (hostapd/CAPWAP), VoIP SBC (Kamailio/rtpengine), captive portal (FreeRADIUS) |
| Deploy pipeline | Database-compiled policy, atomic transactional nftables load, dry-run and rollback, GitOps config sync |
| Resilience | High availability (keepalived + conntrackd session sync), carrier-grade MEF OAM/CFM |
| Multi-vendor | Read-only monitoring and drift detection for OPNsense, Cisco, Fortinet, Palo Alto, Juniper, MikroTik and more |
| Databases | PostgreSQL 16 (79 migrations), Redis 7 |
| API | ~120 route modules across L3–L7 domains |
| Multi-tenancy | Organisation → tenant → sub-tenant; application-enforced isolation; per-tenant envelope-encrypted secrets |
| Host requirements | Linux host with nftables and elevated network capabilities (it manages the host datapath directly) |
| Backend stack | TypeScript on Node.js, Express, PostgreSQL, Redis, BullMQ workers |
| Frontend stack | React 18 with TypeScript, Vite, Redux Toolkit, Tailwind CSS, Leaflet maps, Monaco editor |
| Deployment | Bare metal, Docker Compose, Kubernetes (Helm), cloud VMs, virtual environments, air-gapped |
A self-hosted next-generation firewall. It stores your policy in PostgreSQL, compiles it to real Linux datapath configuration (nftables, Suricata, VPN daemons, DNS/DHCP and more) and deploys it atomically to the host. It spans layers 3 to 7 from a single control plane: filtering, NAT, IDS/IPS, application identification, TLS inspection, four VPN types, SD-WAN, routing, network services, high availability and a web UI.
Your policy lives in the database. When you deploy, it compiles to a complete nftables ruleset and loads in one transaction, so the firewall is never in a half-applied state. If the load fails, it rolls back to the previous ruleset. You can dry-run a change before applying it, and manage configuration through Git for review and versioning.
It can monitor them, not configure them. SinonFirewall connects to OPNsense, Cisco, Fortinet, Palo Alto, Juniper, MikroTik and others read-only: it pulls their configuration, checks health, and detects drift. That is useful for visibility and for planning a migration, but pushing configuration to third-party firewalls is not supported. SinonFirewall configures the firewall it runs.
A Linux host with nftables and elevated network privileges, because it manages the host's datapath directly. It is a real firewall, not a portable app. It deploys on bare metal, Docker (host networking), Kubernetes, virtual environments and air-gapped networks. VPN and routing features use the host's kernel WireGuard, strongSwan and FRR.
Yes. There is an offline bundle packager and air-gap installer that ship everything needed to a local registry, with no outbound dependency. Filtering, VPN, IDS/IPS, routing and the web UI all function with no route to the internet; threat-intelligence feeds are the only part that benefits from external updates.
Closed beta. It is a large, working platform: a full L3–L7 control plane with 79 database migrations and a datapath that drives real system daemons, covered by an end-to-end test harness including tenant-isolation and datapath tests. Request access and we will walk you through the architecture and a deployment plan before you commit anything.
SinonFirewall is in closed beta. Request access for deployment documentation, an architecture walkthrough, and a migration assessment from your current firewall.
Talk to an engineer about running your firewall on infrastructure you own, or let us host it for you and still own every byte.