Internet · NTS — SENTRA Network Threat Shield
Datasheet for the inline network firewall that keeps a whole internet line clean (version 0.18).
Version: 0.18 · Layer: Enforce · Type: inline network firewall (layers 2, 3 and 4)
Protects a whole internet line, not just one website. NTS sits between the internet and the network and cleans all traffic for the organisation's IP addresses before it arrives — so mail servers, VPNs, remote access and every other service behind the line are protected.
How it sits in the line#
Every physical port gets a role: WAN, LAN, management or unused. A WAN and a LAN port form a segment; one box can run several segments of both kinds:
| Segment mode | Behaviour |
|---|---|
| Bridge | Bump in the wire: no IP addresses, no change on the customer side; default "accept" with stateful rules on top |
| Routed | NTS is the gateway with its own routing per segment, NAT and port forwards; default inbound "drop" |
Fail-open: a bridge keeps forwarding even if SENTRA software stops; on bare metal a bypass network card can be driven by NTS.
Key capabilities#
Protection layers#
| Layer | What it does |
|---|---|
| Edge protection | First thing after the network card on every WAN port: allow list, martians, block list, threat feeds, bans, per-source SYN / UDP / ICMP flood limits, customer prefixes with their own counters and limits |
| Policy | Ordered stateful rules per segment and direction (first match wins) with objects, services (36 built in), schedules, expiry, per-source connection limits and hit counts; rule analysis finds shadowed, redundant and unused rules |
| Box protection | Only the management port answers (SSH and the console, from allowed networks) |
| NAT | Masquerade, port forwards with source restriction and hairpin, 1:1 NAT, source NAT |
| AI daemon | Learns normal traffic per WAN port and per customer, flags floods, bans the top sources for a set time, refreshes feeds, alerts |
| Inspection | DNS and HTTPS-name (SNI) filtering (fail-open), firewall log to JSON and syslog, NetFlow v9 export |
| Shaping | Line rates, priority classes and caps by application or category |
| IPS | Suricata intrusion detection and prevention with protocol-based application control |
Networking#
- VPN — WireGuard for remote users and branches (client config and QR code shown once), IPsec IKEv2 for other firewalls; full or split tunnel.
- Multi-WAN — failover or weighted balance across several internet links, with health checks and alerts.
- BGP — announce your own space, take default or full tables, local preference, AS-path prepending, BFD, max-prefix, ECMP, and remotely triggered blackhole to ask carriers to drop attack traffic.
- High availability — two identical boxes with VRRP and synchronised sessions; failover in about 3 seconds; every deploy on the primary is sent to the secondary.
- Interfaces — bonds, VLANs, bridges, per-port MTU (jumbo frames), built from drop-downs.
Operations#
- Monitor and Enforce for the protection layers; explicit policy rules always apply.
- Commit-confirm — every change goes live at once and rolls itself back after 60 seconds unless confirmed.
- Staged changes and revisions — see exactly what a deploy would change; every kept deploy is a numbered revision that can be compared and restored.
- Dashboard customisable per user, with a default layout for everyone; wall mode; light and dark themes.
- Reports — report builder with sections, schedules and e-mail; daily, weekly and monthly reports kept on the box.
- Policy templates — export a box's policy and import it on another; GUARD pushes templates to chosen NTS nodes.
- Alerts — Telegram, e-mail and webhook (Slack, Teams or any JSON endpoint), with a daily digest.
- LAN storm guard — broadcast, multicast and ARP limits per device on every LAN port.
Deployment#
| Option | Description |
|---|---|
| Virtual machine | Deployed by SENTRA GUARD or with the stand-alone installer |
| Bare metal / appliance | Stand-alone installer or deployed by GUARD; supports bypass network cards |
| HA pair | Two identical boxes plus a direct sync cable |
Requirements#
| Item | Requirement |
|---|---|
| Operating system | Ubuntu Server 22.04 or 24.04 |
| Packages | Installed automatically: nftables, iproute2, Python 3, ethtool, conntrack, netplan; optional Suricata (IPS), linux-modules-extra for DNS/HTTPS filtering; WireGuard, strongSwan, FRRouting, keepalived and conntrackd for the features that use them |
| Network ports | At least one WAN and one LAN port per segment, plus a management port; a dedicated sync port for HA |
| CPU / RAM / disk | Sized per deployment — contact SENTRA. For SME and home appliances see the hardware appliance guide. |
Ports and protocols#
| Port / protocol | Use |
|---|---|
| 8443 (TCP, HTTPS) | Console, on the management port only |
| 22 (TCP) | SSH, on the management port only |
| UDP (configurable) | WireGuard VPN |
| UDP 500 / 4500 | IPsec IKEv2 |
| TCP 179 | BGP to carriers |
| VRRP (unicast) and conntrackd | HA pair, over the sync link |
| UDP / TCP (configurable) | Syslog (RFC 5424) to a SIEM |
| UDP (configurable) | NetFlow v9 export |
| 443 (outbound) | Licensing check-in, release server, feeds and alert channels you enable |
Licensing#
Module sentra-nts (or all), bound to the box's Installation ID. 30 days of grace, then changes, AI bans and feed updates pause — protection itself never stops.
Management and security#
- Console with two-factor sign-in and fully customisable roles (16 permissions in 11 groups; built-in Admin).
- Managed by SENTRA GUARD through the node agent when part of a fleet, with central identity and a configurable mapping of GUARD roles to local roles; a glass-break admin works only while the GUARD is unreachable.
- Audit log of every change; signed updates from the release server, installed only when an admin chooses.