Early Access EnforceGate vX Early Access is open — request your invite.
Docs Support Sign in

Secure every web request.
On your own infrastructure.

EnforceGate vX is a self-hosted secure web gateway — URL filtering, network access control, SSL/TLS inspection and a captive portal. Enterprise-grade web security that runs inside your perimeter and deploys in minutes, with no cloud dependency — every request is decided on-box, with no backhaul to a vendor cloud.

Join Early Access
or talk to an engineer
EnforceGate vX
StatusOperational
Connectors5 / 5
Policy rules1,247
# 1 · create a rule — it compiles & reloads automatically [root@xeg01] # eghost policy new 50-block-malware ● compiled /etc/enforcegate/rules.d/50-block-malware.policy ● engine reloaded — no restart, no dropped connections # 2 · dry-run a URL against the live policy [root@xeg01] # egctl show-policy-match "https://www.c2.com/" Verdict: deny Rule: block-malware Action: redirect to captive portal Reason: Known C2 / malware domain [root@xeg01] #
Deploys in minutes on Docker VMware KVM Hyper-V Bare metal Signed & integrity-checked builds Your data stays on-premises 🇨🇭 Engineered in Switzerland
the operator cli

An operator CLI you already know.

If you run Cisco IOS or Juniper Junos, EnforceGate vX feels like home — a real interactive CLI with operational, privileged and configuration modes, show verbs and staged commits. No web console required.

eghost cli — interactive control
[root@xeg01] # eghost cli EnforceGate vX · interactive control — type ? for help xeg01> show policy list ID NAME ACTION MATCH HOSTS 10 block-malware deny domain-list 1,284 20 warn-social warn domain-list 384,217 40 allow-corp permit uri-regex — Total: 3 rules · 385,501 domain hosts loaded (150M capacity) xeg01> enable xeg01# configure terminal xeg01(config)# edit policy warn-social xeg01(config)# commit ✓ validated · applied · snapshot saved xeg01(config)#

  • Cisco IOS & Juniper Junos, in one shell

    It works like the network gear you already run — the same command modes, inline ? help, and a safe staged workflow: you edit a change, commit it, and roll it back if needed. Know Cisco IOS or Juniper Junos? You're productive on day one.

  • Up to 150M rules — built for categories

    The engine loads up to ~150 million rules in memory and matches every request locally — large enough to run full URL-category filtering from your own lists, with no cloud lookup. Benchmarked in under 5 GiB with sub-microsecond decisions that stay flat as the rule set grows.

  • A scriptable toolbox

    Every verb is also a flat, scriptable command. Wrap them in your own shell scripts, cron jobs and CI — a sysadmin-friendly environment you can automate end to end, no SDK required.

the platform

One gateway. Complete control of web traffic.

Every core capability below ships in every edition — no essential filtering, inspection or policy control locked behind a higher tier. Identity-aware access, the web console and operator SSO unlock with Pro and Enterprise.

URL filtering

Allow or deny HTTP and HTTPS by URI, hostname, SNI, user-agent and client IP (MAC on the local segment). Every request gets a per-URL verdict before it leaves your network.

$ egctl show-policy-match "https://…"

Network access control

Permit or deny by identity principal (users, groups), client posture, or network origin — matched on the same attributes as your URL policies.

$ eghost policy new 20-nac-eng

SSL/TLS inspection

Three modes — off, peek (SNI) and bump (full decryption) — so you choose how much HTTPS visibility each deployment needs. The inspection CA is generated in seconds by the interactive installer.

$ eghost restart enforcegate

Captive portal

Block, warn and AUP verdicts redirect the visitor to an in-product explanation page in English, French, German and Italian — with an optional, recorded "Proceed anyway".

$ eghost links

Plain-text policies

Edit .policy files with the editor of your choice such as vi, or nano — domain lists, regex, SNI and user-agent matching. The engine saves a snapshot before every reload, so you can roll back to a previous version with a single command.

$ eghost policy edit 90-denyurlshort

Git-backed policies

Policies and domain/URL lists are plain-text files kept under git. Every change is versioned and attributed — who changed what, when and why — so you can diff, audit and roll back to any point, with the built-in commands or the git you already know.

$ show policy log
solutions

Built for the jobs you actually have.

From acceptable-use enforcement to threat control and guest access — one engine, configured to your policy.

Compliance

Acceptable use & compliance

Enforce what your organisation may browse — block or warn by category, with an Acceptable Use page users acknowledge.

  • Domain-list & regex policies
  • Audited acknowledgement
  • Default-permit or default-deny
Threat control

Malware, phishing & C2 egress

Stop outbound connections to known-bad destinations before they leave your network, with optional HTTPS inspection.

  • Block phishing & C2 domains
  • SSL/TLS inspection (opt-in)
  • Daily-updated threats feed (add-on)
Access

Guest, kiosks & BYOD

Give unmanaged devices safe, filtered access with a self-service CA install page and per-origin policy — no agent required.

  • Self-service CA install page
  • Per users / groups / origin rules
  • Multilingual captive portal
how it works

From signed download to enforcing in three steps.

1

Verify & install

Download the cosign-signed bundle, verify it, and run the guided installer — it loads the images, starts the stack, and waits for the engine to be ready.

$ sudo ./install.sh
2

Point your clients

Send web traffic through the bundled Squid proxy on :3128. The connector forwards every request to the engine over the encrypted Defendr protocol.

$ eghost status
3

Write policies & enforce

Edit plain-text .policy rules in the editor of your choice. eghost policy compiles and reloads the engine live — no restart, no dropped connections.

$ eghost policy new 90-denyurlshort
ClientsHTTP/HTTPS
→
Squid:3128
→
ConnectorDefendr
→
Engineverdict
→
Captive portalblock · warn · aup

And the policy behind it is a plain-text, human-readable file — inline comments, unquoted keys, no rigid syntax. Save it in rules.d/ and it compiles & reloads live.

rules.d/40-web-policy.policy
# plain-text policy — comments and unquoted keys/values block-malware: { action: deny match-domain-list: lists/c2.txt # one domain per line description: Known C2 / malware domains } warn-social: { action: warn # soft-block + AUP notice match-domain-list: lists/social.txt time-window: Mon-Fri 09:00-17:00 # office hours only description: Social media during work hours }
see it in action

From a policy edit to an enforced block — live.

An operator defines a policy in the CLI; a matching request gets a verdict and is redirected to the captive portal — the whole path, in real time, on a single appliance.

Define a policy in the operator CLI — enforcement is immediate, and a blocked request lands on the captive portal.
why EnforceGate vX

The enterprise gateway, re-engineered for ownership.

Everything a secure web gateway should give you — without the cloud lock-in, the per-seat bill, or the expensive hardware. Shipped as signed, verifiable images you run and control — no telemetry, runs air-gapped, and it never stops filtering when a subscription lapses. It scales, too: ~150 million rules matched on-box in sub-microsecond time — see the performance white paper.

Your data stays home

Traffic, policies and logs never leave your infrastructure. No backhaul through a vendor cloud, no data-residency headaches.

Predictable cost

A fraction of a cloud web gateway — priced by edition, not per seat, per Gbps, or per request. You know your spend at signing, with no renewal-time surprises.

Verifiable supply chain

Hardware-anchored signing, in-image integrity checks, and a read-only root filesystem. Trust you can verify, not take on faith.

Swiss engineering & support

Built in the Swiss Alps and supported by the engineers who write the code — with a reply within one business day.

how we compare

A secure web gateway you run — not a cloud you rent.

How EnforceGate vX stacks up against cloud secure-web-gateway services and on-prem proxy appliances — on the criteria that actually move the needle.

EnforceGate vX Cloud SWG / proxy appliance
Deployment Self-hosted container or VM, live in minutes Proprietary appliance, or forced cloud
Your data Stays inside your network Backhauled to the vendor cloud
Scale ~150M rules in <5 GiB, sub-µs, all local Cloud lookups, capped local lists
Management Cisco / Junos-style CLI; plain-text, git-backed policies GUI console and change tickets
Openness Signed, inspectable, adaptable — ships vi, git, bash Sealed, unverifiable appliance
Pricing Flat by edition — no usage metering Per-seat plus bandwidth tiers
Upgrades In-place, 1–2 min Maintenance windows, manual patching
Lock-in No cloud or data lock-in — runs on your infrastructure Deep platform lock-in
Free
Lite is free to run in your own network, and Pro is planned at a fraction of a comparable cloud secure web gateway or proxy appliance. Predictable cost: no throughput tiers, no per-seat creep, no renewal audits.

Comparison reflects typical cloud secure-web-gateway and on-prem proxy deployments; capabilities vary by vendor and tier.

editions

Free to run. Yours to keep.

Start with Lite — free, forever, on a single instance. Pro and Enterprise are on the way for fleets and regulated environments — join the waitlist and we'll tell you when they ship. Every edition is self-hosted, sends no telemetry, runs fully air-gapped, and never stops filtering when a subscription lapses.

Early Access

Lite

Free

perpetual · commercial use permitted

A single instance with the full core secure web gateway: URL filtering, the operator CLI, git-backed policy, bring-your-own community blocklists, and the open captive portal.

Join Early Access
Coming soon
Coming Soon

Pro

~$890 / instance / yr

indicative · pricing confirmed at launch

For MSPs and growing teams: multi-tenant fleet management, managed category and threat-intelligence feeds, automatic updates, ticketed support, and a TLS connector that mirrors decrypted traffic for IDS/IPS.

Coming Soon

Enterprise

Custom

quote-based

For regulated and large fleets: unlimited scale with high availability, SSO and RBAC, compliance exports, SLA support, and the NGFW modules on our roadmap.

What ships in Lite today, and what's planned for Pro and Enterprise. Everything outside the Lite column is on our roadmap — in development, not shipping yet.

Lite
Available
Pro
Coming Soon
Enterprise
Coming Soon
Deployment1 instanceUp to 10 sitesUnlimited + HA
Core SWG · CLI · git policy✓✓✓
Never bricks on expiry ✓✓✓
No telemetry · verifiable offline ✓✓✓
Offline / air-gap activation ✓✓✓
Open captive portal ✓✓✓
Blocklists Community / bring your ownManaged categoriesManaged categories
Threat-intelligence feed ✕✓✓
Directory integration ✕Active DirectoryAD + RADIUS
Multi-tenancy · fleet management✕✓✓
Bundled connector sessions 102550
TLS connector ✕✓✓
Automatic updatesManualOnline / AutomaticOnline / Automatic
SupportCommunityEmail · business hoursPriority SLA
Documentation User docsFull + Integration & Design guidesFull + Integration & Design guides
SSO · SAML · RBAC✕✕✓
Compliance exports (CIPA / GDPR)✕BasicFull + audit log
NGFW modules ✕Add-onIncluded
Best forHomelab · SOHOMSPs · SMERegulated · large fleets
Pro and Enterprise are in development; their columns describe planned capabilities, not a commitment to dates or specifications. Lite is free for a single instance and stays fully operational after release, with no time limit. The Pro price shown is indicative and may change at launch.
questions

Questions, answered.

The things security and IT teams check before they trial a gateway.

What is a secure web gateway?
A secure web gateway (SWG) sits between your users and the internet and decides what web traffic is allowed. In plain terms, it's how an organisation filters and controls internet access — blocking malicious, phishing and unwanted sites, allowing or denying websites by URL or category, and inspecting HTTPS. EnforceGate vX is a self-hosted secure web gateway: it does all of that on your own network, with no cloud.
How do I block or filter websites across my network?
Route your users' web traffic through EnforceGate and define a policy of what to allow or block — by domain, URL, category (adult content, gambling, social media, malware and more), or by user, group and IP. It filters every request on-box and can block, warn or redirect to a captive portal, and plain-text policies reload live so you can change what's blocked without downtime. It's a self-hosted way to filter employee or student internet access without a cloud service.
How is EnforceGate vX licensed?
Three editions — Lite, Pro and Enterprise. Lite is free for a single instance and available now through Early Access. Pro (for MSPs and growing teams) and Enterprise (for large or regulated fleets) are in development — join the waitlist to hear when they ship. There's no per-byte, per-user or per-endpoint metering: Lite is free, and Pro will be priced per instance.
Where does our traffic and data go?
Nowhere external. EnforceGate runs entirely inside your perimeter as a container or virtual appliance — traffic, policies and logs stay on your infrastructure. There is no cloud backhaul and no vendor telemetry on inspected traffic.
How is EnforceGate vX managed?
Three ways, to match how your team works.

Scripted, system-administrator style — drive the engine non-interactively with the egctl utility and clear, self-describing verbs (show-version, show-policy-list, request-policy-reload), ideal for shell scripts, cron and CI.

Interactive, network-engineer style — a modal CLI that blends Cisco IOS and Juniper Junos: add, set, edit, remove, comment and annotate policies, validate them, and roll a change back, all without leaving the session. Staged edit → commit → rollback will feel familiar to anyone who runs Junos.

REST Client API (coming soon) — integrate EnforceGate with your own tooling and automation.

In every case the underlying policy configuration is backed by git, so every change is versioned, easy to back up, and simple to diff or audit.
How large does EnforceGate vX scale?
The engine loads and matches up to ~150 million rules entirely in memory, with every request evaluated locally — no cloud lookup. In our in-house benchmark, 150 million rules ran in under 5 GiB with common-case decisions in about 0.2 µs — and that decision time stayed flat as the rule set grew from 50M to 150M, so adding rules adds memory, not delay (see the performance white paper). You scale out, or run high availability, by adding engines — planned for Pro and Enterprise. Cost follows your deployment footprint, not traffic or rule count, so growth stays predictable.
Can it filter by category?
Yes. A category is simply a domain or URL list a policy points at — adult content, gambling, hacking tools, social media, or any other grouping you define. Source them from community-maintained lists our documentation points to, or any public blocklist you prefer, and community scripts fetch, convert and refresh them into the engine's local .policy lists. Matching stays on-box with no cloud category service and no per-request lookup, and the ~150-million-rule capacity is large enough to load full category sets. You decide which categories to enforce and how current they are — Exosys doesn't impose a fixed taxonomy.
Can it restrict outbound traffic from servers (egress filtering)?
Yes — it's not only for user web access. Deploy it as an outbound HTTP/HTTPS egress filter in a DMZ or data-centre segment and route your servers' outbound web traffic through it. Whitelist only the destinations each server legitimately needs — package mirrors (apt, yum, npm, PyPI), OS and software update endpoints, and licensing or telemetry — and deny everything else by default. A compromised or misconfigured server then can't reach an attacker's endpoint, which shrinks the attack surface and blocks data exfiltration and command-and-control callbacks. Because policies are plain-text and git-backed, the allowlist stays auditable and reviewable like any other change.
Can I just build this on Squid myself?
Squid is part of what we ship — but turning a bare proxy into a managed web gateway is the hard part, and the open-source add-ons people used to reach for to do it are largely unmaintained today. EnforceGate is the maintained, supported layer on top: a verdict engine that matches up to ~150 million rules in memory, the interactive Cisco IOS / Juniper Junos-style CLI and scriptable command-line tooling, a category-list workflow, signed and integrity-checked images, and a Swiss engineer to call. You get a product that stays current — not a pile of cron jobs and abandoned plugins to maintain. (If you're replacing the dead SquidGuard layer specifically, see our SquidGuard alternative page.)
Is SSL/TLS inspection legal to enable?
Inspection ships disabled by default. peek reads only the SNI; bump performs full decryption and requires an explicit, audited acknowledgement before it will start. Whether decryption is lawful depends on your jurisdiction and the notice or consent you provide — you remain responsible for that determination. In bump mode you also distribute the inspection CA to client trust stores, and certificate-pinned applications — many banking and mobile apps, and some SaaS — can't be decrypted and need explicit bypass rules.
How long does deployment take?
Minutes. Download the signed Docker bundle, verify it, run the guided installer, and point your clients at the proxy. Prefer a VM? The turnkey virtual appliance ships as ready-to-import images in OVA, QCOW2, VHDX and VMDK formats for VMware, KVM and Hyper-V. Either way, the engine self-initialises its keys, certificates and a default policy on first boot.
How are upgrades performed?
Upgrades are in-place and seamless — typically 1–2 minutes end to end, with under a minute of service interruption while the new components start. Your configuration, license activation, policy history and audit log are preserved across upgrades, including yearly release transitions. On the virtual appliance the host operating system updates continuously as atomic, rollback-capable snapshots, so the OS underneath is always current — only the EnforceGate components are swapped at upgrade time. Docker deployments simply pull the new image versions.
Can it run air-gapped or offline?
It depends on the edition. Lite (free) has no licence validation and no expiry — it runs indefinitely with no connectivity to Exosys. Pro and Enterprise activate once per validity period (yearly): the engine validates its licence against the Exosys Control Server at activation, then caches it, so it runs the rest of the year with no ongoing connectivity. For air-gapped or restricted networks, we provide an offline-activation procedure for Pro and Enterprise.
What support is included?
Every licence includes Direct support — email and a support portal, triaged by an Exosys engineer who works on the product, not a community forum. Extended, a paid upgrade available on Pro, adds scheduled callbacks and priority engineering triage. Premium, included with Enterprise, adds a named engineering contact, special-release builds and rollout consultation.
free forever

Test EnforceGate vX in your own network.

Join the Early Access waiting list. If you're selected, we'll email your invite and the verified download — no credit card, no sales call.

Please accept the Privacy Policy to continue.
Something went wrong — please try again.
No spam. Unsubscribe anytime.
✓

You're on the list.

If you're selected, we'll email with your invite and download.