KORTHVEILSecurity firewall
Sign in Get Korthveil
Layer-7 next-generation firewall

See every connection.
Control it in plain words.

Korthveil is a next-generation firewall for your own hardware. It knows devices, applications, websites and people. It draws your rules as a live flow, and it tells you why something was blocked.

See pricing Explore features
Home from $39/yr Business from $129/yr 34 add-in modules
Korthveil shield
L7Applications, sites and users, not just ports
IPv4 + IPv6Every feature, both families
15 sLive updates without a restart
1-clickUndo: every change can roll back
Visual rule designer

Your rules as a live flow

Every rule is drawn from zone to zone through the firewall, with moving arrows that show what it decides. Press a rule to see only its path. The designer then answers in words whether the rule is working, and which earlier rule decides if it is not.

  • Easy and Expert modes
  • "What would you like to do?" wizards, one question at a time
  • Test a connection: see exactly which rule decides
Built in

Everything a modern network needs

A complete firewall in the Core, and add-in modules for what you choose.

🛡️

Rules that explain themselves

"Blocked by your rule #6, not an attack": the card names the rule, the devices and the address, with its owner and country.

🌐

VPN routing with a kill switch

Send chosen devices through NordVPN, IPVanish or any WireGuard provider, with failover and the fastest tunnel.

📊

Traffic you can follow

A live flow from source to rule to destination, measured every 2 seconds. Point at anything to see its conversations.

🔁

Failover pairs

Two firewalls, one shared gateway. The standby takes over by itself and the configuration syncs.

📱

Phone as backup internet

Plug in an iPhone or Android phone. When your line drops, Korthveil switches to it and switches back.

🧩

34 add-in modules

IPS, web filter, WAF, NAC, SD-WAN, Wi-Fi, DNS ad blocking and more. Pay only for the ones you use.

Your hardware

Runs on what you already have

Any 64-bit computer or virtual machine that Debian 13 supports, with two network interfaces. No proprietary box and no hardware lock-in. Your license moves with you.

  • Install from a USB stick, or over the network
  • Updates in about 15 seconds, with automatic fallback
  • Configuration you can export, restore and roll back
Supported hardware

From a mini PC at home to a redundant rack pair

Korthveil installs on standard 64-bit Intel and AMD hardware, or in a virtual machine. Pick the size you need: the software is the same everywhere.

Home and small office

Quiet mini PC with a desktop UPS

  • Mini PCs and fanless boxes with two to six Intel or Realtek ports
  • 2 cores, 4 GB RAM and a 32 GB disk run the core firewall
  • A UPS on USB: on a power cut Korthveil shuts down cleanly, and can shut down your NAS or PC first
  • Your phone as backup internet over USB, and Wi-Fi from a supported radio
Business and branch

Multi-port appliance, ready for IPS

  • Desktop or 1U appliances with 4 to 8 ports, 2.5 GbE and SFP+ 10 GbE
  • 4 or more cores and 8 GB RAM for intrusion prevention, web filtering and TLS inspection
  • LTE or 5G modem as a backup line
  • A UPS on USB or with a network (SNMP) card, watched by Network UPS Tools
Enterprise and data center

A failover pair of rack servers

  • 1U and 2U rack servers with Intel or AMD processors and ECC memory
  • 10, 25, 40 and 100 GbE cards from Intel, NVIDIA Mellanox, Broadcom and Chelsio
  • Two firewalls share the gateway address and keep connections and configuration in sync; the standby takes over in seconds
  • Install from USB, over the network (PXE), or through the server's remote console
Power protection

When the power fails, everything shuts down in the right order

Korthveil watches your UPS and decides when to act, by time on battery, remaining runtime or charge, or the UPS's own low-battery warning.

  1. 1Power failsThe UPS reports it is on battery; you get an alert.
  2. 2Standby goes firstIn a failover pair the standby shuts down early to save battery; the active firewall keeps the gateway.
  3. 3Your machines nextServers, NAS and PCs you choose are shut down over SSH, and other UPS clients are told to stop.
  4. 4The firewall lastKorthveil shuts itself down cleanly, with time to spare. Test shutdown runs the whole sequence as a dry run.

UPSes on USB, with an SNMP network card, or on another Network UPS Tools server: most APC, CyberPower, Eaton, Tripp Lite and other models it supports.

Sizing guide

UseCPURAMDisk
Home, core firewall2 cores4 GB32 GB
Office with IPS, web filter, VPNs4+ cores8 GB64 GB SSD
Large network, 10 GbE and up16+ cores32 GB ECC240 GB SSD

Intel or AMD 64-bit (x86-64-v2 or newer), two or more network ports, UEFI or legacy BIOS.

Also supported

  • Network cards: Intel, NVIDIA Mellanox, Broadcom, Chelsio, Marvell and Realtek, copper and SFP
  • Virtual machines: KVM, Proxmox, XCP-ng and VMware, with virtio, vmxnet3 and Xen drivers
  • Disks: SATA, NVMe, SAS controllers and hardware RAID; optional mirror of two disks
  • Extras: LTE and 5G modems, Wi-Fi radios, USB phone tethering, iSCSI and NVMe over TCP storage

Priced to beat every firewall on the market

Home from $39 a year. Business from $129 per firewall. The Full Suite with every module costs $79 for Home and $299 for Business.

Build your license Let us manage it