Testing and non-enforcing modes let operators inspect before they enforce.
Security and policy
Put policy and detection in one Manager.
Zwall distributes rules and blocks from the Manager, detects common attack patterns from configured sources, and keeps enforcement on Agents that are allowed to enforce. Hosting Agents observe; they do not receive firewall rules. AI Preview can help investigate. Operators apply policy.
Policy Engine
Rules, blocks, and related objects
| Object | Operator meaning |
|---|---|
| Firewall rules | IP/CIDR/port/protocol/MAC-oriented policy (assign-to-agent) |
| Blocked IPs | Central blocked-IP authority (fail-closed design for blocking authority) |
| GeoIP country policy | Applies when GeoIP data is configured |
| External blocklists | Ingested lists |
| DNS rules | Implemented (not a resolver WAF) |
| Detection settings | Per-agent detection |
Flow
From detection to policy
Configured source produces an event. Manager stores a security log and may propose a temporary block. Operator reviews in the console (or optionally triggers AI Preview). Operator applies or extends a real rule/block on a Virtualization Agent. Hosting nodes remain observation-only.
Detection
Detection from configured sources
Brute-force style detection from monitored authentication logs, with optional block. Scan and flood controls. Login rate limiting. Temporary-to-permanent block promotion. DNS RBL lookups.
ModSecurity observation path (global metadata on Hosting; not "Zwall is ModSecurity"). These are implemented capabilities with uneven validation — they are implemented, not certified.
Integrations
Integrations that exist
Email, generic webhooks, and Slack-style incoming webhook delivery (not a Slack App marketplace product). Prometheus scrape of /metrics when enabled. Grafana JSON for operator-hosted Grafana. GeoIP, RBL, blocklists, libvirt, ModSecurity as documented public integration pages.
Optional Cloudflare IP synchronization and the Unblock Portal (captcha/admin review) exist as Enterprise capabilities. Do not name Splunk, SIEMs, Terraform, OIDC as first-class public integrations.
AI Context
AI Preview relationship
AI Preview is advisory only. Operators optionally trigger it on eligible security events to get an explanation or draft recommendation. It does not apply blocks.
Boundaries
What Security is not
Security Non-Claims
- No compliance certifications (SOC 2, ISO, HIPAA).
- No fine-grained public RBAC product.
- No UID/GID customer contract.
- DNS rules are not a DNS WAF.
- Updater/signing-key control plane is not the security story.
Workflow
Evaluation Workflow
- 01 Review the Rules and Blocks documentation.
- 02 Configure detection settings in the Manager console.
- 03 Assign test rules to an enforcing Virtualization Agent.
- 04 Verify blocks are applied and synced to eBPF maps.
Docs
Security Documentation
Frequently Asked Questions
Does Zwall replace my existing host firewall?
Not as a certified drop-in. Virtualization XDP can sit in front of netfilter; validate locally.
Does the Hosting Agent enforce these rules?
No.
Do you have SOC 2 or ISO?
No such public claim.
Is GeoIP included out of the box?
GeoIP policy applies when GeoIP data is configured.
Does AI apply blocks?
No.
Can I use Terraform to manage rules?
No native Terraform provider.
Ready to secure your hosts?
Evaluate Zwall Community or talk to an engineer about Enterprise features.