Support Request a demo

Every connection, verified at the gate.

NXSgate splits your network into zones and checks every connection that crosses between them. When something is blocked, allowed or flagged, NXS Explain shows you which layer decided and why, straight from the firewall's own records.

Request a demo Take the tour
  • Zone-based rules
  • Every decision explained
  • Multi-WAN with NXS Braid

Built for networks in

  • Financial services
  • Healthcare
  • Education
  • Public sector
  • Retail
  • Manufacturing
One console

Your firewall on the desk, the tablet and the phone.

The Overview tells you whether everything is OK at a glance: health, CPU, memory, sessions, throughput, VPN users and what was blocked today. Every page works at phone width too.

Illustration of the NXSgate console on a monitor, a tablet and a phone, with the line "Clarity. Control. Security. A unified view of your network." The monitor shows a security overview with sessions, inspected traffic, threats blocked, WAN availability, a traffic graph, priority actions, WAN paths and recent detections. The tablet shows NXS Braid paths and the phone a compact security overview.
Illustration. The numbers are examples. Real screens from our lab are in the product tour.
Zone-based security

Split the network into zones. Check everything that crosses.

Put your interfaces, VLANs and VPN tunnels into zones like LAN, DMZ, Guest and IoT. One rule list, written from zone to zone, decides what may cross, the way enterprise firewalls do it. Nothing moves between zones until a rule allows it.

  • Blocked by default. Traffic can't cross from one zone to another unless a rule says so, and the default deny logs what it stopped.
  • One rule list. Every rule names its zones, so you can tell what it's for by reading it. Port forwards add their zone rule for you.
  • Attackers stay put. If a camera in the IoT zone gets hacked, it still can't reach your servers.
  • Changes you can take back. A zone change runs on a timer. Keep it, or NXSgate undoes it by itself, so a mistake can't lock you out.
See how zones work
NXS Explain

Stop guessing why traffic was blocked.

Pick any event, log line or live connection and NXS Explain answers from the firewall's own records: which engine decided, which rule matched and what it said at the time, what NAT and routing did, and what to check next. Every answer says how sure it is.

  • Observed

    A record on the firewall shows it, with a reference.

  • Inferred

    Follows from the records. The reasoning is shown.

  • Predicted

    What the current rules would do. Never shown as fact.

  • Unavailable

    Not recorded, and it says so instead of guessing.

How NXS Explain works
NXS Explain showing a blocked connection: dropped by spoof protection on the second WAN link, marked Observed, with the rule, policy version and firewall named, then each layer on its own: firewall permission, IPS verdict, DNS and web filtering, and App Control.
The platform

Everything between the internet and your network.

Protection, application control, inspection and multi-WAN, set up in one console and explained by the same engine.

8layers explained separately for every connection
326applications in the App Control catalog
1,925application activities catalogued
16security posture checks, each with a fix

NXSGuard

Intrusion prevention, country blocking, threat feeds, and DDoS, scan and spoof protection. One page shows what each of them stopped in the last 24 hours.

Learn more

App Control

See which apps are in use and block single activities inside them, like YouTube video. It always tells you what can be controlled today.

Learn more

DNS & web filtering

Allow, warn or block websites by category, with a clear block page. Malware and phishing domains are stopped at the first lookup.

Learn more

Inspect

For devices you manage: see AI prompts, searches and uploads, and scan downloads before they arrive. Devices you don't manage are never decrypted.

Learn more

Security posture

Sixteen weighted checks, from default passwords and two-factor sign-in to updates and backups. The score shows its formula, and each check has a fix link.

Learn more

High availability

Pair two firewalls with shared addresses and state sync. In our lab, a live connection kept running through failover and failback.

Learn more
NXS Braid · multi-WAN

Every link. One connection.

Two or more internet links work as one. Share traffic by the percentage you choose, fail over in your order, or bond them so a single download or call uses every link at once through an NXS Braid tunnel.

  • Bonding. In our lab, one upload ran at 32 Mbit/s over two 20 Mbit/s links.
  • Shield for calls. Calls go out on the two best links at once: 0.3% loss instead of 5% over two lossy links.
  • Instant reconnect. When a link fails, devices are told at once, so apps reconnect in seconds instead of hanging.
  • No surprises. Test failover with one click, and see where each link's traffic would go if it failed now.
Speed gauge per linkScheduled speed testsFlap dampeningPassive health
NXS Braid WAN performance: a speed gauge for each internet link with latency, jitter and loss, scheduled speed tests, and a combined gauge for all links together.
Multi-tenant & data center

One box, many firewalls. Every server in view.

Split one NXSgate into separate firewalls for tenants, branches or a lab, and map a data center's devices, traffic and segmentation from the firewall's own records.

The Virtual firewalls page: the root firewall and a vNex called Branch A, each with its own WAN and LAN ports, and an Open console button for the vNex.

Virtual firewalls (vNex) In lab testing

Each vNex is a firewall of its own, with its own ports or VLANs, zones and rules, NAT, routes, DHCP and DNS, and its own console. vNex links connect two of them, and each side's zone rules decide what crosses.

How vNex works
NXS Grid topology: the firewall at the centre with its LAN, gateways, site-to-site tunnels and discovered devices, each line drawn by how it is known.

NXS Grid In lab testing

Topology, live traffic flows, assets and a zone-to-zone segmentation matrix, built only from what the firewall sees. Findings say what they're based on, and NXS Grid never changes a rule by itself.

How NXS Grid works
How it works

Each layer decides for itself, and says so.

A firewall permission isn't an IPS verdict, and an alert isn't a block. NXSgate keeps every layer's decision apart and records it, so you always know what actually happened to a connection.

  1. 01

    Match zones

    Every interface, VLAN and tunnel belongs to a zone, so NXSgate always knows which boundary a connection is crossing.

  2. 02

    Stop known threats

    Country blocking, threat feeds, attack shields and the IPS each get their say, and each one counts what it stopped.

  3. 03

    Apply the zone rule

    The rule for that pair of zones allows or blocks. DNS and web filtering, App Control and Inspect apply their own policy.

  4. 04

    Route & record

    SD-WAN or NXS Braid picks the link. Every decision is logged, so NXS Explain can answer for it later.

Operations

Run it like an enterprise firewall.

A rule list your team can read, policy you can keep in git, and logs and alerts that go where you already work.

  • Policy as code. Zones, rules and server groups as one document. Apply it through the API, and if nobody keeps the change, it's undone completely.
  • Logs and alerts where you work. Log search on the firewall, SIEM export as JSON or CEF, and alerts to email, Slack, Teams or a signed webhook.
  • Updates that undo themselves. A new version starts on trial. If its health checks don't pass within 10 minutes, NXSgate goes back to the previous one.
  • Many firewalls, one view. NXSgate Central shows the health of every firewall. They connect out to it, so nothing reaches back in.
See management features
Product tour

See it for yourself.

Real screens from a running NXSgate firewall in our lab.

The NXSgate Overview: a status strip of eight cells, live WAN throughput and the security posture score with the checks that need attention.
One status strip tells you whether everything is OK. Live throughput, posture, alerts and activity sit below it.
NXSGuard security overview: threats stopped in 24 hours, intrusion attempts, a protection score, and the protection pipeline from countries and threat feeds through attack shields, IPS, DNS security, web and apps to Inspect.
Every protection between the internet and your devices, with what each one stopped in the last 24 hours.
NXS Explain on an allowed connection that raised an IPS alert: the alert is not called a block, the NAT translation is shown, and each layer is listed separately.
An allowed connection with an IPS alert. The alert isn't called a block, and the NAT translation is shown.
The App Control catalog: activities grouped by what identifying them needs, from network signatures to decrypted parsers, with counts for each.
The full application catalog, with what each activity needs before it can be controlled.
SD-WAN overview: internet links with latency, jitter and loss measured over the last 10 minutes, and site-to-site paths to other branches.
Every internet link and every site-to-site path, measured live.
NXS Braid WAN mode: choose load balance, failover or bonding, set the failover order, with live gauges for every link.
Load balance, failover or bonding, chosen in one place, with live gauges for every link.
Inside a vNex called Branch A: its own console, switched to from the top bar, showing only the vNex's own WAN and LAN interfaces with their addresses and traffic.
Inside a vNex: its own console, with only its own ports. The switch in the top bar goes back to the Global view.
The NXS Grid overview: discovered assets, observed traffic flows, active network devices, unidentified assets, segmentation violations and critical findings, a topology, top talkers, collector health and the highest-bandwidth links.
A data center at a glance: assets, live flows, segmentation findings and which data sources are collecting.
Deployment

Run it where your traffic is.

One image for the hardware you choose or a virtual machine, with the same software and console everywhere.

Your own hardware

Install NXSgate on a mini PC or server with two or more network ports.

  • ISO installer for x86-64
  • Four steps: disk, ports, administrator, review
  • WAN and LAN ports picked during install

Virtual machines

Run the same image on the hypervisor you already use.

  • Tested in our lab on VMware
  • High-availability pairs with state sync
  • Segment server tiers in the data center
In development

NXSgate appliances

Purpose-built boxes for branch offices and small sites, running the same software.

  • First models being qualified now
  • Same console and policy as every NXSgate
  • Updates that roll back if checks fail

See what's really crossing your network.

Book a 30-minute walkthrough with one of our security engineers. We'll show you NXSgate and put together a traffic risk report for your network.

Request a demo View pricing