Observe service, panel, and network signals without turning a shared host into a firewall. Enterprise Hosting Agent.
Explore Hosting Self-hosted Linux infrastructure security
A self-hosted security control plane for Linux infrastructure.
You operate one Manager. The Hosting Agent is Enterprise: it observes shared and panel-managed nodes without dropping packets. Virtualization Agents enforce packet policy on KVM/libvirt hosts at XDP ingress and TC egress. PostgreSQL is the Manager system of record for policy, identity, and events on the control plane you host.
Audience
Built for people who run the hosts
Zwall is for hosting providers, VPS and cloud operators, service providers, and infrastructure security teams. If you operate Linux hosts for customers or platforms, you need more than a generic dashboard and more than a host firewall you cannot see across.
Apply packet policy on the KVM/libvirt host with XDP on ingress and TC on egress.
Explore Virtualization Architecture
One Manager you host. Agents that observe or enforce.
Operators talk to the Manager over HTTPS. The Manager authenticates administrators and Agents, stores policy and events in PostgreSQL, and serves the console. REST /api/v1 and zwallctl are how you automate. Agents keep the profile that belongs on that machine.
SYSTEM ARCHITECTURE MAP
Operators
Console, API/REST, zwallctl CLI
TELEMETRY INWARD
POLICY OUTWARD
Operating properties
Enforcement. Durability. Verifiability. Recoverability.
Enforcement
Packet policy is enforced on Virtualization Agents with XDP on ingress and TC on egress. The Hosting Agent is Enterprise: it observes and must not drop.
Durability
PostgreSQL is the Manager system of record. Agents keep local credentials and node state on the host. Event transport is designed as at-least-once with idempotent acceptance — not a lossless capture product.
Verifiability
Zwall Enterprise is designed around verified signed-release admission. Database schema admission is a separate step from starting the Manager. Community is a source build you can inspect.
Recoverability
You operate PostgreSQL backups and host state. Policy and identity live on the Manager you host, in both editions. A named rollback contract is published on Reliability when that program is accepted — this card is not an RPO/RTO.
Packet path
Kernel programs follow the job on the host
OBSERVE
pass-only eBPF on hosting nodes
ENFORCE
firewall XDP ingress, firewall_egress TC egress
UID/GID cgroup filtering is not a public customer contract yet.
Operations
What operators actually do
See.
Hosting Agents collect service and panel signals and observe the network without dropping packets. Operators review bounded telemetry and events in the console.
Control.
Virtualization Agents can apply packet policy on KVM/libvirt hosts with XDP and TC. Rules, blocks, GeoIP, and detection settings live on the Manager. Hosting Agents cannot receive firewall rules.
Investigate.
AI Preview is operator-controlled investigation with customer-provided OpenAI-compatible credentials. It does not apply firewall rules.
Trust
Trust is how you admit the bits
- 1 Verified signed release
- 2 Database schema admission
- 3 Manager start
Administrators can require TOTP.
Zwall Enterprise is designed to consume verified signed releases. Database schema admission is separate from starting the Manager, and administrators can require TOTP. See Security and Trust for the exact admission and identity model.
Security and Trust Deployment models Certification (when published)
Editions
Community and Enterprise are different products
Zwall Community is free and open source (AGPL-3.0-only), with up to three Agents per Manager. Virtualization exists in Community. The Hosting Agent and AI Preview do not.
Zwall Enterprise is the commercial edition for hosting-scale deployment and the broader platform. Pricing is custom.
Zwall Community
Zwall Community is free and open source, with up to three Agents per Manager.
Zwall Enterprise
Zwall Enterprise is the commercial edition for hosting-scale deployment and the broader platform. Pricing is custom.
Explore Zwall Community — 3 Agents per Manager Pricing
Product
Where to go next
Console
Operator surface, not a published rating
The web console is the primary operator surface. The image is a session traffic view. Values on screen are not a published PPS or throughput rating.
Documentation
Start in Docs
Frequently asked questions
Is Zwall a cloud firewall?
No. You host the Manager and the Agents.
Is every Agent a firewall?
No. Hosting Agents observe and must not drop. Virtualization Agents can enforce.
Does Community include the Hosting Agent?
No.
Do I need AI to enforce packet policy?
No. AI Preview is optional Enterprise investigation.
What does Enterprise cost?
Custom Pricing. Talk to an Engineer about your environment.
Where do I start in Docs?
Overview, then Editions, then Deployment models.
Do you publish a certified OS/kernel matrix?
Not yet. See Supported Platforms and System requirements.
Is event delivery lossless?
No. Zwall does not publish a lossless-delivery guarantee.
Talk to an Engineer
Talk to an Engineer about the Linux estate you run, or explore Zwall Community on GitHub.