Attacks never reach
youyou.

NuajProtect is edge security that blocks malicious traffic before it reaches your servers, routers and networks. It combines live global threat intelligence with detection that runs where your traffic actually arrives — floods, port scanners, repeat offenders and abuse your own applications report — and enforces the result inline, with no proxy in the path.

The NuajBridge appliance protects a whole network with nothing to install. The same engine — intelligence and detection both — runs as software on your Linux servers and as generated rule chains on MikroTik routers, so every deployment is a sensor as well as an enforcement point. No re-architecting required.

A firewall enforces the static rules you write, and it can only act on what those rules already describe. NuajProtect adds the part a rule can’t express. It feeds your edge a live picture of known-hostile infrastructure and removes it in the path, and it decides about traffic nobody has classified yet: floods judged against the baseline your link actually runs at rather than a fixed number, scanners that give themselves away by touching ports nothing legitimate touches, repeat offenders escalated on their own record, and application-level abuse your own software reports from inside. What one protected site works out, the others enforce. It complements your firewall — it doesn’t replace it.

There is no proxy and no extra routing hop: filtering happens at the earliest point in the traffic path, so accepted traffic is forwarded rather than reassembled. What you should watch for is not throughput but a wrong call — any filter can misjudge unusual but legitimate traffic. That is what the allowlist, the per-endpoint activity view and monitor mode are for: run it watching before you run it blocking.

Both. Run it fully self-hosted for data sovereignty and air-gapped environments, or use the managed SaaS and let us operate the control plane for you.

NuajProtect is in beta, and free to join. NuajBridge appliances — 2.5G and 25G — are coming soon, and beta members get priority access as each model ships. Protect a server in software in minutes, reserve a NuajBridge for whole-network protection, or talk to us about a larger deployment.

A flood is only a flood relative to what your link normally carries, so NuajProtect measures the baseline your connection actually runs at and judges against that rather than against a number someone typed in. When a source crosses it, the drop is enforced at the earliest possible point, before it reaches your application, and with no proxy in the path. Reflection and amplification floods are caught the same way, which matters because they are usually a small share of a big link rather than an obvious spike. Run it in monitor mode first: you watch the calls it would make against your own traffic before any of them are enforced.

Yes, and not as an afterthought. Blocklists, allowlists, detection and enforcement are dual-stack throughout, on every platform — the Linux agent, MikroTik address lists and the NuajBridge appliance. An edge that filters only IPv4 is an edge with a second, unguarded front door.

The edge keeps enforcing what it already knows. Blocking is local — the device itself holds the lists — so a network problem between you and us costs you updates, not protection. On the Linux agent you can still see and change what is being enforced through a console bound to the loopback address, which is also the way back in if a rule ever locks you out.

Fail2ban bans an address after it fails on one server, reading that server’s own logs. NuajProtect blocks known-hostile sources from live threat feeds before they connect, detects floods, port scans and brute-force attempts where your traffic arrives, and enforces what one edge learns on every edge you run, from one dashboard. Like CrowdSec it learns from a community, and you choose who you share with and how many separate devices must report an attacker first.

No. It runs on-premise, at your own edge: on a NuajBridge, your Linux servers or your MikroTik routers. Your traffic is never rerouted through a third-party scrubbing centre, so your routing stays exactly as it is. An attack larger than your internet link still has to be stopped upstream, by your provider.