NuajProtect · Deployment
Two separate decisions. What runs the protection — the Linux agent, your MikroTik router or a NuajBridge appliance. And where it sits relative to the traffic it protects — Sentry, Relay or Bridge. Six of the nine pairings exist; this page shows which, and why the others do not.
Types and modes
Type · software
A single static binary under systemd. It picks the fastest protection the server supports, so an older box is still fully protected.
Type · router
No binary: you paste one generated script into the router’s terminal, and it installs managed rule chains and address lists on the router you already own. Enforcement is RouterOS’ own firewall, so it inherits that hardware’s limits — and its strengths.
Type · appliance
The full engine on purpose-built hardware, filtering a whole network in the path. It carries the parts that only exist when we control the box: acceleration matched to its hardware, sealed port roles, and inline placement with no address for an attacker to reach.
The protection runs on the thing it defends. Traffic to and from that host is filtered on the host itself, and software on the host can hand the agent an attacker it spotted at the application layer. The default for servers and VMs.
A forwarding gateway cleans traffic on its way to services that never see the raw Internet. Traffic reaches them directly or through a tunnel — GRE, WireGuard, or IPsec — so the protected addresses need not be exposed at all.
Two ports, no IP address on the data path, transparent to everything either side of it. Nothing has to be readdressed to deploy it, and there is no management surface in the traffic path for an attacker to find.
| Linux agent | MikroTik | NuajBridge | |
|---|---|---|---|
| Where it can sit | |||
| Sentry — protects itself | Yes | Yes | — |
| Relay — protects downstream | Yes | — | Yes |
| Bridge — transparent inline | — | Yes | Yes |
| How it enforces | |||
| Enforcement | Accelerated | RouterOS firewall | Accelerated |
| Older Linux versions | Supported | — | — |
| Whole-network filtering | Per host | To the router’s limits | Yes |
| Defence layers | |||
| Allowlist · blocklist · banlist · country | Yes | Yes | Yes |
| Gatekeeper trap ports | Yes | Yes | Yes |
| Flood protection | Adaptive + fixed limits | Fixed limits, IPv4 | Adaptive + fixed limits |
| IPv6 | Yes | Yes | Yes |
| Running it | |||
| Keeps filtering if the server is unreachable | Yes | Yes | Yes |
| Apps on the host can report attackers | Yes | — | Yes |
| Stays current | Signed self-upgrade | Automatic list sync | Signed self-upgrade |
A dash means the pairing is not supported. Relay is not supported on RouterOS — the rules NuajProtect installs there filter the forward chain, so a MikroTik covers downstream devices in Sentry or Bridge mode. Sentry is not supported on a NuajBridge: its data path carries no IP address of its own. Bridge is not supported on a Linux agent; transparent inline filtering runs on the appliance, on hardware we build and validate. The pairings are enforced when an endpoint is created.
Get started
Every type and every placement is managed from the same account. Protect a server or a router in software today; add a NuajBridge when you want the whole network covered.