Operators talk to the Manager. The Manager talks to Agents. Each Agent does the job that belongs on that host. The console, REST API, and zwallctl are how you drive the platform.
Running large Linux hosting or KVM/libvirt environments requires distinct approaches to security and observability. Standard host firewalls drop packets indiscriminately or lack central management.
Zwall is designed so you can observe hosting nodes without turning them into firewalls, and enforce packet policy on virtualization nodes, all from a single self-hosted control plane.
Console, API/REST, zwallctl CLI
The platform consists of a single central control plane interacting with two specialized data plane Agents.
Hosting Agents observe and must not drop. Virtualization Agents can enforce.
Hosting Agent
Observe
Pass-only network observation
Virtualization Agent
Enforce
Packet policy enforcement (XDP/TC)
The Manager is the control plane you host. It authenticates administrators and Agents, stores policy and events in PostgreSQL, distributes rules and blocks, and serves the console.
PostgreSQL is the Manager system of record. Agent local state is separate (credentials, caches, node files). The operator API is REST at /api/v1.
Administrators create rules, blocks, GeoIP policy, and detection settings on the Manager. Assigned Virtualization Agents synchronize those objects and program kernel maps.
Hosting Agents do not receive firewall rules (the Manager returns HTTP 409). Security logs, Hosting events, heartbeats, and virtualization inventory flow Agent → Manager. AI Preview, when enabled, reads already ingested security events — it does not attach programs and does not become a block.
The web console is the primary operator surface: fleet, firewall, detection, Hosting and Virtualization views, logs, and settings.
Zwall Enterprise also includes AI Preview and license-related operational screens — those screens existing is not a certification of production-wide HA or a public price list. Automation uses REST /api/v1 (there is no generated OpenAPI and no public GraphQL product). zwallctl is the operator CLI. Packet enforcement does not depend on opening the console.
| Capability | Zwall Community | Zwall Enterprise |
|---|---|---|
| License / commercial | AGPL-3.0-only; Free / Open Source | Commercial; Custom Pricing |
| Agents per Manager | 3 (enforced) | Licensed entitlements |
Manager, console, /api/v1, zwallctl | Yes | Yes |
| Virtualization Agent (KVM/libvirt) | Yes (source install) | Yes |
| Hosting Agent observation | No | Yes |
| AI Preview | No | Yes, off by default |
| Signed-release database admission | No | Yes |
| Public repository | https://github.com/zwall-net/zwall-community | Private product tree |
AI Preview is a Zwall Enterprise capability, off until an operator enables it. You supply credentials for an OpenAI-compatible endpoint (including a local compatible server). The Manager holds the key.
The model can explain selected security events and draft recommendations. Approving a recommendation does not apply a rule. Provider-backed AI does not automatically analyze Hosting Agent sources. A dedicated private Zwall AI offering is in development and is not generally available.
No. You host the Manager and the Agents.
No. Hosting Agents observe and must not drop. Virtualization Agents can enforce.
No.
No. AI Preview is optional Enterprise investigation.
PostgreSQL.
Overview, then Editions, then Deployment models.
Evaluate Zwall Community or talk to an engineer about Enterprise.
