🔒
Every connection is authenticated and authorized over a modern, fast WireGuard VPN tunnel enforced by the sdwan overlay transport module.
- WireGuard/IPsec/OpenVPN tunneling with cluster and client orchestration in the sdwan module.
- No implicit trust based on network location — every request is authenticated and authorized independently.
- Full tunnel is the default for new clients, giving the headend complete visibility to inspect and filter traffic.
- Split tunnel lets selected trusted destinations bypass the VPN, with every route validated (domain, wildcard, IPv4/IPv6, CIDR) before acceptance.
🔑
X.509 client certificates combined with JWT/SSO integration for defense-in-depth identity verification.
- An X.509 client certificate is validated at the Go headend on every connection; a JWT token authorizes subsequent API calls.
- Both factors are verified independently before a client is granted access.
- Local username/password authentication with bcrypt hashing, HTTP-only/Secure/SameSite session cookies, and configurable session timeout is always available.
- Enterprise adds SAML2, OAuth2, and LDAP/Active Directory SSO with attribute-to-role mapping, plus TOTP/SMS/FIDO2 multi-factor authentication — the local auth baseline is never removed.
📜
The core API runs a full certificate authority (root + intermediate CA) that issues, rotates, and revokes client and server certificates automatically.
- Root CA / Intermediate CA issuance chain for headend and client identities.
- Certificates are generated automatically on client registration, and clients fetch renewed certificates before expiration.
- An admin can revoke a client certificate immediately, cutting off headend access.
- Client-side CLI commands (cert-info, renew-cert) surface certificate status without a portal round trip.
🛡️
The sase module inspects traffic with threat feeds, a vulnerability scanner, DDoS/rate-limit protection, and context-based adaptive authentication.
- URL/domain category filtering combining an inline Radix tree with an async AI tier.
- IDS/IPS threat feeds and a vulnerability scanner feed enforcement decisions.
- Context-based/adaptive authentication: threat intel, impossible-travel detection, and risk-based step-up.
- Enforcement actions include drop, reject, soft-block, log-only, and branded block pages.
🔍
SPAN/monitor-port mirroring to Suricata, Zeek, Arkime, Strelka, and CAPE feeds a shared indicator store for retroactive block enforcement.
- Mirror targets receive a copy of traffic via SPAN/monitor-port with zero latency impact on live traffic.
- Detection adapters normalize analysis output to STIX 2.1 indicators.
- A shared, deduplicated, TTL'd, threat-intel-merged IOC store (Valkey) is read by inspection points to enforce retroactively on future traffic.
- Supports VXLAN/GRE/ERSPAN mirroring from the Go headend.
🌐
Enterprise network segmentation and dynamic routing through FRR integration, with domain/IP/protocol/port firewall rules enforced on every proxied connection.
- Basic firewall rules (domain, IP, protocol, port) are available at every tier via the sdwan module.
- Advanced firewall rules, VRF support, and OSPF routing are Professional-tier entitlements.
- A built-in access-testing tool validates whether a target/port/protocol would be allowed before a rule is deployed.
- VRF and OSPF neighbor state are queryable through the network management API for operational visibility.
☸️
Kubernetes CNI
A high-performance Container Network Interface plugin extends the same WireGuard overlay to pod-level networking in Kubernetes clusters.
- Pod-level networking runs over the same overlay transport as client and headend connections.
- Scales from a single Docker Compose host up through multi-node and multi-region Kubernetes deployments.
💻
Purpose-built desktop GUI clients for macOS, Windows, and Linux, headless builds for servers and embedded systems, and mobile apps for iOS and Android.
- Desktop GUI clients for macOS (Universal, Intel, Apple Silicon), Windows 10/11, and Linux (amd64/arm64) with system tray connect/disconnect and real-time status.
- Headless CLI-only builds target servers, Docker containers, Raspberry Pi (ARM v6/v7), and router firmware (MIPS/MIPSLE) for automation and daemon-mode operation.
- A Docker container client pulls its configuration from the core API using a temporary API key, with automatic certificate rotation.
- Mobile apps are available for iOS and Android.
- All client variants share one authentication flow: an API key bootstraps registration, after which the core API issues an X.509 certificate and JWT.
📈
Network performance testing and monitoring, fully merged into Tobogganing as the perftest module family — no separate WaddlePerf service or deployment.
- HTTP/HTTPS (1.1/2/3), TCP (raw/TLS/SSH), UDP (raw/DNS), and ICMP (ping/traceroute) testing, plus browser-based speed tests.
- Real-time test progress streamed over WebSocket to the portal's Live Test view.
- AutoPerf runs a per-policy, three-tier state machine (baseline / escalated / critical) that automatically increases check frequency on a threshold breach and de-escalates after consecutive clean cycles.
- FleetDM-style device enrollment via a per-org-unit secret; Community tier allows up to 5 active enrolled devices.
- Cluster-to-cluster testing runs source×destination test matrices across node/region pairs on a recurring schedule (Professional tier).
🕊️
A secure, scalable DNS-over-HTTPS (DoH) proxy with token-based authentication and fine-grained, per-domain access control — merging into Tobogganing as the netsvcs module, standalone v2.1.1 today.
- DNS-over-HTTPS (RFC 8484) resolution with HTTP/3 support, replacing cleartext UDP/TCP port 53 DNS.
- Bearer-token authentication scoped to specific domains — exact names, subdomain wildcards, or a full wildcard for unrestricted resolution.
- DNS blackholing via Maravento blackweb list integration plus admin-managed custom blacklists, with an IOC/threat-intelligence view in the admin console.
- Optional mutual TLS (ECC P-384 client certificates) for dual authentication alongside the bearer token.
- Valkey/Redis-backed response caching with automatic in-memory fallback if the cache is unavailable.
- Local DNS forwarding lets a client run as a UDP/TCP port 53 forwarder, so existing applications and OS resolvers need no changes.
🔐
Offload JWT signing and data-encryption keys to AWS KMS or GCP Cloud KMS — private key material never leaves the KMS.
- By default, Tobogganing uses an in-app key provider suitable for Community deployments.
- Enterprise deployments can offload RS256 JWT signing and AES-256 data encryption to AWS KMS or GCP Cloud KMS.
- Only signatures and unwrapped data-encryption keys are returned by the KMS — private key material never leaves it.
- JWT verification happens locally against a cached public key, with zero KMS calls per request.
🖥️
A single, manifest-driven React portal covering every module — new modules appear in the sidebar automatically, with no per-module UI to maintain.
- On login the portal fetches the module manifest (nav entries, feature-flag states, and the caller's role) from the core API and renders the sidebar and routes from it.
- Write-capable (admin) and read-only (viewer) roles are evaluated per module from JWT claims.
- Built with React 18 + TypeScript (Vite 5), TanStack Query 5, react-router 6, and TailwindCSS 4, served by its own Express container.
- Exposes Prometheus metrics and Kubernetes-style health endpoints (/health, /healthz) alongside the core API and headend.