Virtual firewalls and edge services

Protect each tenant edge with managed virtual firewalls, routing, NAT and site-to-site connectivity, all from one platform and without extra hardware.

How it works

Traffic from the internet reaches a tenant’s own virtual firewall, which handles NAT and routing, zone policy rules and WireGuard VPN, before reaching the tenant’s two networks and their VMs.

See it in action

The firewalls page, with the console menu beside it: one running virtual firewall with its two interfaces, its size and its high availability setting.

Key benefits

  • Firewall controls for each tenant, without complex shared policies

  • Virtual, centrally managed controls in place of scattered appliances

  • NAT, zones, routing and rules standardised everywhere

  • Managed site-to-site overlays instead of custom engineering

  • A clear lifecycle for edge services, through change and retirement

  • Less repetitive security work, with tenant separation kept

Feature breakdown

  1. Per-tenant virtual firewalls

    Security boundaries follow service ownership, so each customer or business unit is clearly separated without extra effort. Structured policies replace one-off rule changes.

  2. NAT, routing, zones and policy rules

    Consistent edge controls meet governance standards and stay flexible for different workloads and tenants. Standard policies mean less variation and troubleshooting as you grow.

  3. Site-to-site overlays and WireGuard VPN

    Built-in WireGuard management makes connectivity part of daily operations, not a separate project. That helps organisations with many sites, customer zones or recovery locations.

  4. Managed lifecycle for edge services

    Setup, policy updates and ongoing management follow one lifecycle, without undocumented manual steps. Changes carry less risk across environments and staff.

What it means in practice

Deliver secure tenant edge services as a repeatable platform capability rather than bespoke firewall projects.

Secure every tenant at the edge