Frequently asked questions

A secure web gateway (SWG) sits between your users and the internet and decides what web traffic is allowed. In plain terms, it's how an organisation filters and controls internet access: blocking malicious, phishing and unwanted sites, allowing or denying websites by URL or category, and inspecting HTTPS. EnforceGate vX is a self-hosted secure web gateway: it does all of that on your own network, with no cloud.

EnforceGate ships with Squid as its bundled forward proxy; EnforceGate itself is the policy engine Squid asks for a verdict on every request. So clients are pointed at that proxy rather than having their traffic silently intercepted: you publish it on port 3128 through the usual proxy settings, whether that is a PAC or WPAD file, browser or operating-system proxy configuration, or group policy.

That covers anything that speaks HTTP through a proxy, not only workstations and laptops: printers and other appliances, and servers, which you can restrict to the destinations they legitimately need such as package mirrors and vendor update endpoints. Used that way it acts as an HTTP firewall for outbound web traffic.

You then define a policy of what to allow or block: by domain, URL, category (adult content, gambling, social media, malware and more), or by user, group and IP. Every request is decided on-box and can be blocked, warned or redirected to a captive portal, and plain-text policies reload live so you can change what's blocked without downtime. It's a self-hosted way to filter employee or student internet access, and to control what your servers and devices may reach, without a cloud service.

Yes. A category is simply a domain or URL list a policy points at: adult content, gambling, hacking tools, social media, or any other grouping you define. Source them from community-maintained lists our documentation points to, or any public blocklist you prefer, and community scripts fetch, convert and refresh them into the engine's local .policy lists. On Pro, Business and Enterprise (Business and Enterprise are in development), the Exosys Curated Domain Lists add 60+ ready-made categories, classified with state-of-the-art AI, downloaded once at install and fully offline, refreshed several times a day on our side, with optional incremental updates from a CDN. Either way, matching stays on-box with no cloud category service and no per-request lookup, and the ~150-million-rule capacity is large enough to load full category sets. Because every rule is matched in memory, adding more categories or domains costs memory, not speed: the per-request decision time stays essentially constant (about two-tenths of a microsecond) as the rule set grows, so there's no performance penalty for filtering on more categories. You decide which categories to enforce and how current they are; Exosys doesn't impose a fixed taxonomy.

Yes, and being open to outside intelligence is a genuine difference from the big vendors. Cloud secure web gateways from the likes of Cisco, Palo Alto Networks and Zscaler are built around their category database and their cloud: you largely enforce the taxonomy they ship, decisions run through their service, and folding in large external feeds or your own intelligence is limited to what the platform chooses to allow.

EnforceGate is open by design. An optional, sandboxed toolbox sidecar ships a real scripting environment (bash, Python 3, curl, git, jq and pip), so you can pull any source on a schedule: the free UT1 category corpus, abuse.ch's ThreatFox and URLhaus threat feeds, a commercial feed you already subscribe to, or your own internal lists. A short script converts each source into an on-box list and reloads the engine live, and matching stays entirely local, with no per-request cloud lookup.

This works on every edition. Prefer not to assemble your own? Pro, Business and Enterprise also bundle the Exosys Curated Domain Lists (60+ AI-classified categories), but you can always add, replace or blend in your own sources.

Yes: it's not only for user web access. Deploy it as an outbound HTTP/HTTPS egress filter in a DMZ or data-centre segment and send your servers' outbound web traffic through it, by setting the usual proxy variables (http_proxy / https_proxy) or each tool's proxy setting. Whitelist only the destinations each server legitimately needs: package mirrors (apt, yum, npm, PyPI), OS and software update endpoints, and licensing or telemetry, then deny everything else by default. A compromised or misconfigured server then can't reach an attacker's endpoint, which shrinks the attack surface and blocks data exfiltration and command-and-control callbacks. Because policies are plain-text and git-backed, the allowlist stays auditable and reviewable like any other change.

Nowhere external. EnforceGate runs entirely inside your perimeter as a container or virtual appliance; traffic, policies and logs stay on your infrastructure. There is no cloud backhaul and no vendor telemetry on inspected traffic.

Inspection ships disabled by default. peek reads only the SNI; bump performs full decryption and requires an explicit, audited acknowledgement before it will start. Whether decryption is lawful depends on your jurisdiction and the notice or consent you provide; you remain responsible for that determination. In bump mode you also distribute the inspection CA to client trust stores, and certificate-pinned applications (many banking and mobile apps, and some SaaS) can't be decrypted and need explicit bypass rules.

Yes, that's what the TLS connector is for. It's a TLS proxy that performs the same SSL/TLS decryption (SSL bump) as Squid, but caches nothing. Its job is visibility: an optional tap duplicates the decrypted HTTP traffic as clear text onto an Ethernet interface, so out-of-band security tools (an IDS, a DLP system or a traffic monitor) can listen to it. They can then spot data exfiltration, malware and command-and-control (C2) traffic that would otherwise be hidden inside HTTPS, and run precise protocol analytics. Because the tap only mirrors traffic out-of-band, it never sits in the request path: no added latency, no dropped connections. The TLS connector is part of the Business and Enterprise editions.

Three ways, to match how your team works.

Scripted, system-administrator style. Drive the engine non-interactively with the egctl utility and clear, self-describing verbs (show-version, show-policy-list, request-policy-reload), ideal for shell scripts, cron and CI.

Interactive, network-engineer style. A modal CLI that blends Cisco IOS and Juniper Junos: add, set, edit, remove, comment and annotate policies, validate them, and roll a change back, all without leaving the session. Staged edit → commit → rollback will feel familiar to anyone who runs Junos.

REST Client API (coming soon). Integrate EnforceGate with your own tooling and automation.

In every case the underlying policy configuration is backed by git, so every change is versioned, easy to back up, and simple to diff or audit.

It comes down to whether the portal knows who the user is.

Standard (Pro) has no user awareness: it acts on the request and its network origin, not on an identified person. It is source available, so you get the source and can modify it, whether that means restyling and rewording it for your organisation or adding features of your own, under our licence terms rather than an open-source one.

Advanced (Business) is user aware: it knows which user a session belongs to and works alongside Active Directory integration, so block, warn and acceptable-use pages, and the acknowledgements they record, can be tied to the person rather than to an IP address.

Enhanced (Enterprise) builds on that and adds the AI assistant that answers a user's "why was this blocked?" question in the page itself.

Yes. The captive portal (the page a user lands on when a request is blocked, warned, or needs an acceptable-use acknowledgement) is a self-contained Python application, not a locked binary. You can rebrand it: your logo and colours, your own copy, a helpdesk contact and the acceptable-use wording your organisation requires, in the language your users read (it ships in English, French, German and Italian). Pro ships the standard portal, which is source available: you get the source, so you can read exactly what it does and adapt it, under our licence terms rather than an open-source one. Business ships the advanced portal, and Enterprise the enhanced portal, which adds an AI assistant that answers users' "why was this blocked?" questions.

The engine loads and matches up to ~150 million rules entirely in memory, with every request evaluated locally with no cloud lookup. In our in-house benchmark, 150 million rules ran in under 5 GiB with common-case decisions in about 0.2 µs, and that decision time stayed flat as the rule set grew from 50M to 150M, so adding rules adds memory, not delay (see the performance white paper). You add capacity with connector sessions (Pro 25, Business 40, Enterprise 50), and scale out, or run high availability, by adding engines (planned). Cost follows your deployment footprint, not traffic or rule count, so growth stays predictable.

Minutes. Download the signed Docker bundle, verify it, run the guided installer, and point your clients at the proxy. Prefer a VM? The turnkey virtual appliance ships as ready-to-import images in OVA, QCOW2, VHDX and VMDK formats for VMware, KVM, Hyper-V and Nutanix AHV. Either way, the engine self-initialises its keys, certificates and a default policy on first boot.

Upgrades are in-place and seamless: typically 1–2 minutes end to end, with under a minute of service interruption while the new components start. Your configuration, license activation, policy history and audit log are preserved across upgrades, including yearly release transitions. On the virtual appliance the host operating system updates continuously as atomic, rollback-capable snapshots, so the OS underneath is always current; only the EnforceGate components are swapped at upgrade time. Docker deployments simply pull the new image versions.

Yes. Every edition activates once per validity period (yearly): the engine validates its licence against the Exosys Control Server at activation, then caches it, so it runs the rest of the year with no ongoing connectivity. The Exosys Curated Domain Lists work the same way: downloaded once at install and fully usable offline, with incremental updates only if you opt in. For air-gapped or restricted networks, we provide an offline-activation procedure.

Per instance, per year, with no per-byte, per-user or per-endpoint metering. Three editions, Pro, Business and Enterprise, differ by the capabilities they unlock and the connector sessions they bundle. Pro is available today; Business and Enterprise are in development. See the editions table for what each one includes and what it costs.

Squid is part of what we ship, but turning a bare proxy into a managed web gateway is the hard part, and the open-source add-ons people used to reach for to do it are largely unmaintained today. EnforceGate is the maintained, supported layer on top: a verdict engine that matches up to ~150 million rules in memory, the interactive Cisco IOS / Juniper Junos-style CLI and scriptable command-line tooling, a category-list workflow, signed and integrity-checked images, and a Swiss engineer to call. You get a product that stays current, not a pile of cron jobs and abandoned plugins to maintain. And because the gateway is built on Squid, you also get its caching: frequently-requested content is served straight from the on-box cache instead of being re-fetched, which can improve page-load times for your users. (If you're replacing the dead SquidGuard layer specifically, see our SquidGuard alternative page.)

Support comes with the edition. Pro includes Direct support: email and the online bug-reporting tool in your Exosys account, where you can raise a bug or a feature request and follow its status. Reports are triaged by an Exosys engineer, so they reach the people who work on the product rather than a community forum. Business includes Advanced support, which adds scheduled callbacks and priority engineering triage, and can be upgraded to Premium. Enterprise includes Premium support: a named engineering contact, special-release builds and rollout consultation.