korridor — Secure your access without a third-party service

The firewall knows nothing about your users

It opens ports to IP addresses. When someone leaves the organisation, their access has to be removed by hand — and it rarely is.

The reverse proxy knows nothing about your links

The fibre goes down, 5G takes over, and tunnels and certificates only find out afterwards.

SaaS knows everything — but at a third party

The value is real. So are the opacity of a service you cannot audit and traffic that transits through a third party. And it stops at the network: not your firewall, not your links.

In between, no trace at all

Who changed what, when, and is that really what is running? A per-site admin interface answers none of those three questions.

01 — Write

The bundle is YAML, reviewed like code and versioned in git — or composed in the control plane. To the edge it is the same thing: a file.

02 — Sign

A detached signature, with the private key kept off the host. No configuration- or binary-signing key sits at the edge: the host only holds the public keys that verify them.

03 — Ship

The binary is signed too. The switchover is blue-green under a watchdog: if the new generation does not become ready, the old one automatically takes over again.

04 — Verify, then apply

Invalid signature, version going backwards, unknown field: rejected, and the last valid configuration stays in force. From the firewall up to L7.

Web publishing

Serving your applications and sites, under TLS, with no stack to assemble.

• HTTP/1.1, HTTP/2 and HTTP/3 reverse proxy
• TLS certificates issued and renewed automatically, without opening port 80
• Load balancing across several servers, with a circuit breaker for servers that fail
• WebSocket, event streams and streaming, with no per-route configuration
• Static site hosting with in-memory cache and compression
• Waiting room: an admission queue that triggers automatically on a traffic spike or an incident

Application security

Filtering before the request ever reaches your application.

• Coraza WAF and OWASP rules, switchable on and off route by route
• Rate limiting, globally or per source
• Country and reputation-list filtering, applied before authentication
• Behavioural abuse detection: error bursts, scanning, object ID enumeration
• Security headers, CORS and blocking of sensitive paths
• Content-security-policy violation collection

Identity and access control

Who reaches what, re-evaluated on every request — Zero Trust taken literally, with no trust granted to the originating network.

• Policy re-evaluated on every request, never only at sign-in
• A sign-in portal that works with your identity provider
• A standalone enrolment portal: email code, authenticator app, passkeys
• Different proof levels depending on the resource requested
• Service tokens for machine-to-machine exchanges
• Client certificate, time windows, address ranges, groups and domains

Site network

The entry point also handles L3 and L4 on the machine.

• An nftables firewall described entirely in the configuration
• Multi-WAN: every link tested through itself, with automatic failover and failback
• Two-machine high availability, virtual address taken over in 0.45 seconds
• TCP and UDP proxying for SSH, RDP and databases
• Approvals and enrolments replicated between machines, with no database
• Upgrading one machine by draining it, without a service interruption

Remote access

Reaching a site or an internal network without opening an inbound port.

• A remote site publishes itself by connecting out to the edge, opening no port at all — and it is the same korridor at the other end, not a separate agent
• Roaming machines on Linux: the internal network goes through the edge, the internet stays direct — TCP, UDP and ping
• Per-device rules: named services, networks and ports, and where needed an identity proven at the portal
• Device enrolment with explicit approval; removing a device from the configuration also cuts its live tunnel
• If a point of presence does not answer, the device connects to the next one on its list
• An audit line when each device flow opens and when it closes
• Pass-through without decryption for services that handle their own TLS
• The visitor's real address preserved end to end

Operations

What it takes to run the machine over time.

• Signed configuration, hot-reloaded; an invalid version is never applied
• Signed upgrade, without downtime, with automatic rollback
• Prometheus metrics and JSON logs your SIEM can use
• A local diagnostic console: traffic, tunnels, cluster, links, system
• Secrets encrypted at rest; a stolen file on its own does not decrypt
• No database; beyond the system's own nftables, no third-party software required

Privilege separation

The process that faces the internet does not run as root by default: it sheds every privilege except binding port 443, and forcing it to root triggers a warning at start-up. What touches the kernel — firewall, virtual address, routing — lives in a supervisor with no public network surface. A compromised web component has no right to reconfigure the network.

No configuration key at the edge

The exposed machine holds no configuration- or binary-signing key, only the public keys that verify them: it can neither forge a configuration, nor manufacture an upgrade, nor issue a federated identity. The one private key it keeps is the one that signs roaming-device certificates, encrypted at rest, and a device is enrolled only after explicit approval.

Deny by default

The safe posture is the absence of configuration. A route without a policy is not published. An unknown tunnel is refused. A machine with no declared network reaches nothing. A forgotten access stays closed.

Identity drives the network

An enrolment opens a port, its expiry closes it again. When someone proves their identity at the portal, the firewall rule follows within milliseconds — with no integration to write between two products.

You are leaving SaaS, or you can no longer enter it

NIS2, DORA, HDS regulation; traffic and logs leaving your premises; a service that cannot be audited. korridor delivers the same application-level value on your machines, with a configuration your auditor can read line by line.

You have sites, not a network team

Branches, workshops, laboratories. One appliance per site: firewall, two internet links, VPN, application publishing, identity portal — configured by a signed file pushed remotely, rather than through a web interface, site by site.

You expose your customers' applications

Hosting and managed-service providers: every customer connects out to your points of presence without opening a single inbound port. Routes and policies are per customer, in a versioned artefact. A point of presence can be replaced without anyone reconnecting.

You maintain a hand-assembled stack

A reverse proxy, an application firewall, an authentication proxy, a tunnelling service, an ACME client, a failover daemon: six lifecycles, six configurations, none of them signed. korridor consolidates the lot behind a single artefact, with no database and no third-party component to operate — the firewall relies on nftables, which the system provides.