EnforceGate vX

EnforceGate vX is a self-hosted secure web gateway (SWG) that runs entirely on-premises as a container or VM and thus with no cloud dependency. All traffic decisions are made locally on the appliance. Core capabilities: - URL Filtering: Evaluates HTTP/HTTPS requests by URI, hostname, SNI, user-agent, and client IP or MAC address, issuing a per-request verdict before traffic leaves the network. - Network Access Control: Permits or denies traffic based on identity principals (users, groups), client posture, or network origin. - SSL/TLS Inspection: Supports three modes — off, peek (SNI only), and bump (full decryption). An inspection CA is generated during installation. - Captive Portal: Redirects blocked, warned, or AUP-triggered requests to an explanation page available in English, French, German, and Italian, with an optional recorded "Proceed anyway" action. - Plain-text Policies: Rules are written in human-readable .policy files supporting domain lists, regex, SNI, and user-agent matching. The engine saves a snapshot before every reload for rollback. - Git-backed Policy Management: All policies and domain/URL lists are plain-text files versioned under git, enabling diff, audit, and rollback. The operator interface uses a Cisco IOS / Juniper Junos-style CLI with operational, privileged, and configuration modes, staged commits, and rollback support. The underlying proxy is Squid on port 3128, with client traffic forwarded to the policy engine via the Defendr protocol. Threat control use cases include blocking outbound connections to known C2, phishing, and malware domains, with an optional daily threat-intel feed on Business and Enterprise editions. The product ships as cosign-signed images with a read-only root filesystem and supports air-gaped deployments.