The firewall knows nothing about your users
It opens ports to IP addresses. When someone leaves, somebody has to remember to go back over it — and nobody does.
Zero Trust edge appliance
korridor
What protects your sites fits in a file you can read. korridor brings firewall, multi-WAN, high availability, reverse proxy, WAF, per-user access control and remote access together in a single product. No database, no third-party software: to reach an internal site, korridor is what you put at the other end too. And it does not configure itself — it verifies a signature, then it applies.
One binary, no databaseed25519-signed configurationPrivilege separationOn your own machines
The problem
Six products that never talk to each other, and no one able to say what is actually running.
The reverse proxy knows nothing about your links
The fibre goes down, 5G takes over, and tunnels and certificates only find out afterwards.
SaaS knows everything — and bills per seat
The value is real. So is a cost that tracks headcount, a black box you cannot audit, and traffic routed through a third party. And it stops at the network: not your firewall, not your links.
In between, no trace at all
Who changed what, when, and is that really what is running? A per-site admin interface answers none of those three questions.
The answer
An artefact signed in a safe zone, applied at the edge by a process that is not root. The chain is short and every link can be checked.
01 — You write it
The bundle is YAML, reviewed like code and versioned in git — or composed in the control plane. To the edge it is the same thing: a file.
02 — You sign it
A detached signature, with the private key kept off the host. The host holds public keys only: it can sign nothing.
03 — You ship it
The binary is signed too. The switchover is blue-green under a watchdog: if the new generation does not become ready, the old one takes back over on its own.
04 — The edge verifies, then applies
Invalid signature, version going backwards, unknown field: rejected, and the last valid configuration stays in force. From the firewall up to L7.
What it replaces
A stack to operate and version, turned into a line of configuration. The left-hand column is what you already maintain.
| What you operate today | In korridor |
|---|---|
| pfSense / OPNsense / network appliance + plugins | An nftables firewall generated from the bundle, applied before routing comes up |
| `ip rule` scripts or a multi-WAN router | Uplinks probed through their own link, with automatic failover and failback |
| keepalived + HAProxy + a session store | Two machines are enough: virtual address, replicated state, upgrades without downtime |
| Nginx + ModSecurity | HTTP/1.1, HTTP/2 and HTTP/3 reverse proxy + Coraza WAF and OWASP CRS |
| oauth2-proxy, Authelia, home-grown forward-auth | An access policy evaluated on every request, and an OIDC portal that works with your identity provider |
| No equivalent: a full identity provider to host | A standalone enrolment portal: email code, authenticator app, passkeys — with no identity provider at all |
| cloudflared, ngrok, frp | Inbound tunnel: two korridor instances chain together, the remote site dials the edge and opens no port |
| OpenVPN / WireGuard + scripts, or a mesh subscription | Split-tunnel roaming client: the internal network goes through the edge, the internet stays direct |
| certbot / cert-manager | Automatic ACME per host, without ever opening port 80 |
| Ansible + apt, and a maintenance window | A signed upgrade, watchdog-gated, without downtime |
The access portal, screen by screen
This is the only interface korridor serves itself, and it needs nothing installed: no identity provider to host, no agent on the machine. A visitor proves they control an authorised mailbox, picks a second factor, and their source address is approved for as long as you decided. The screenshots come from a demonstration instance: the account, the gateway and the services shown are fictional.
An email address, and nothing else to remember
No password to create, so no password to steal or reset. The portal caps sends per source, and the browser solves a proof of work before a single message leaves: rotating IP addresses is not enough to flood your mailboxes. The authorised-access warning is served by the portal; it is not something you configure.
The second factor is a choice, not a constraint
Authenticator app or passkey: the user picks at enrolment, and a user enrolled on several methods picks at sign-in. A passkey is phishing-resistant and device-bound; an authenticator app needs no hardware. The strength required is set per resource — a monotone ladder, from a plain email code to a mandatory hardware factor.
Losing a phone does not take the site down
Backup codes are issued once, at enrolment, and never shown again. They are the only way out that needs nobody else — everything else goes through a reset from the host, which is traced.
Identity drives the network, not just the web
Once the proof is made, the source address is approved and the firewall rule follows within milliseconds — then disappears on its own when it expires. That is what opens SSH, RDP or a database to the person who has just authenticated, with no integration to write between firewall and directory, and without leaving a port open to the whole internet the rest of the time.
Everyone manages their own authenticators
Adding a passkey, removing one, switching device, regenerating backup codes: users do it themselves, and every change demands a fresh proof on the spot. One admin queue fewer.
The same portal on a phone
The layout recomposes on a narrow screen: the form takes the full width, choices stack, nothing is hidden behind a menu. Nothing to install either, no app to publish in a store — it is a web page, and that is what makes it available on a borrowed machine as well as on a phone.
What can be checked
The threat model is the argument, not the datasheet. "Zero Trust" means nothing on its own: here it comes down to four properties, and each one is readable in the configuration rather than in a brochure.
Privilege separation
The process that faces the internet never runs as root. What touches the kernel — firewall, virtual address, routing — lives in a supervisor with no public network surface. A compromised web component has no right to reconfigure the network.
No keys at the edge
The exposed machine can sign nothing. It holds public keys only: it can neither forge a configuration, nor manufacture an upgrade, nor issue a federated identity.
Deny by default
The safe posture is the absence of configuration. A route without a policy is not published. An unknown tunnel is refused. A machine with no declared network reaches nothing. People forget to close; they do not forget to open.
Identity drives the network
An enrolment opens a port, its expiry closes it again. When someone proves their identity at the portal, the firewall rule follows within milliseconds — with no integration to write between two products.
What you get
No module to buy, no option to switch on. There is no "enterprise" edition: the plan changes the service commitment, never the product.
Web publishing
Serving your applications and sites, under TLS, with no stack to assemble.
- HTTP/1.1, HTTP/2 and HTTP/3 reverse proxy
- TLS certificates issued and renewed automatically, without opening port 80
- Load balancing across several servers, with a circuit breaker on the ones that fall over
- WebSocket, event streams and streaming, with no per-route configuration
- Static site hosting with in-memory cache and compression
- Waiting room: an admission queue that trips by itself on a spike or an incident
Application security
Filtering before the request ever reaches your application.
- Coraza WAF and OWASP rules, switchable on and off route by route
- Rate limiting, globally or per source
- Country and reputation-list filtering, applied before authentication
- Behavioural abuse detection: error bursts, scanning, credential enumeration
- Security headers, CORS and blocking of sensitive paths
- Content-security-policy violation collection
Identity and access control
Who reaches what, re-evaluated on every request — Zero Trust taken literally, with no trust granted to the originating network.
- Policy re-evaluated on every request, never only at sign-in
- A sign-in portal that works with your identity provider
- A standalone enrolment portal: email code, authenticator app, passkeys
- Different proof levels depending on the resource requested
- Service tokens for machine-to-machine exchanges
- Client certificate, time windows, address ranges, groups and domains
Site network
The entry point holds the machine at L3 and L4 as well.
- An nftables firewall described entirely in the configuration
- Multi-WAN: every link tested through itself, with automatic failover and failback
- Two-machine high availability, virtual address taken over in 0.45 seconds
- TCP and UDP proxying for SSH, RDP and databases
- Approvals and enrolments replicated between machines, with no database
- Upgrading one machine by draining it, without a service interruption
Remote access
Reaching a site or an internal network without opening an inbound port.
- A remote site publishes itself by dialling out to the edge, opening no port at all — and it is the same korridor at the other end, not a separate agent
- Roaming machines: the internal network goes through the edge, the internet stays direct
- Authorisations per device, network by network and port by port
- Device enrolment with explicit approval
- Pass-through without decryption for services that handle their own TLS
- The visitor real address preserved end to end
Operations
What it takes to hold the machine over time.
- Signed configuration, hot-reloaded; an invalid version is never applied
- Signed upgrade, without downtime, with automatic rollback
- Prometheus metrics and JSON logs your SIEM can use
- A local diagnostic console: traffic, tunnels, cluster, links, system
- Secrets encrypted at rest; a stolen file on its own does not decrypt
- No database, no third-party software required to run
All of these capabilities are shipped and in service. korridor holds the entry point of the Koraisoft infrastructure itself — it is the product we operate the longest every day.
Who it is for
Four situations where the current stack costs more than it protects.
You are leaving SaaS, or you can no longer enter it
NIS2, DORA, HDS regulation; traffic and logs leaving your premises; a cost that tracks headcount; a black box impossible to audit. korridor delivers the same application-level value on your machines, with a configuration your auditor can read line by line.
You have sites, not a network team
Branches, workshops, laboratories. One appliance per site: firewall, two internet links, VPN, application publishing, identity portal — configured by a signed file pushed remotely, not by a web interface clicked through site by site.
You expose your customers applications
Hosting and managed-service providers: every customer dials out to your points of presence without opening a single inbound port. Routes and policies are per customer, in a versioned artefact. A point of presence can be replaced without anyone reconnecting.
You maintain a hand-assembled stack
Nginx, ModSecurity, oauth2-proxy, cloudflared, cert-manager, keepalived: six lifecycles, six configurations, none of them signed. korridor consolidates the lot behind a single artefact, with no database and no third-party component at runtime.
What korridor does not do
The scope is deliberately kept narrow. Here is where it stops — and saying so up front beats finding out later.
No turnkey global network
korridor holds your sites and your machines. Load distribution between distant points of presence is built with you; it is not delivered as an anycast service.
Not a router
No IPsec, no BGP, no OSPF, no captive portal, no QoS. The firewall and multi-WAN exist because the entry point needs them — not to compete with a carrier router.
No SSH session recording
If your tender requires it today, korridor does not answer that line. It is an identified piece of work, not a ticked box.
No configuration interface
This is the structural choice of the product: everything goes through a signed, reviewed file. If your operations rely on an interface to click through, korridor will ask for a change of habit.
No extension ecosystem
Against a community package catalogue, korridor offers a small, audited surface instead. That is a deliberate trade-off, not a gap to fill.
A demonstration on your topology, not a slide deck
Allow half a day: we write the bundle for your first site, sign it, deploy it on a machine of yours, and you leave with the file — readable, versioned, reversible. Pricing is counted in nodes and sites, never per seat or per request; we send you the rate card on request.
Request a demonstration