NuajProtect · Deployment
Choose what runs the protection — the Linux agent, your MikroTik router or a NuajBridge appliance — and where it sits: Sentry, Relay or Bridge. Six of the nine pairings exist; here is which, and why.
Types and modes
Type · software
One static binary under systemd, on x86-64 and arm64. It picks the fastest protection the server supports, so an older box is still fully protected.
Type · router
Paste one generated script into the router’s terminal. It sets up managed rule chains and address lists on the router you already own, enforced by RouterOS’ own firewall — with that hardware’s limits, and its strengths.
Type · appliance
The full engine on purpose-built hardware, filtering a whole network in the path — with acceleration matched to its hardware, sealed port roles, and no address for an attacker to reach.
Coming soon
Protection runs on the machine it defends, and software on that host can hand the agent an attacker it spots. The default for servers and VMs.
A forwarding gateway cleans traffic for services that never see the raw internet — directly, or through a GRE, WireGuard or IPsec tunnel, so their addresses stay hidden.
Two ports, no IP address on the data path, transparent to both sides. Nothing is readdressed, and there is no management surface in the path for an attacker to find.
| Linux agent | MikroTik | NuajBridge | |
|---|---|---|---|
| Where it can sit | |||
| Sentry — protects itself | Yes | Yes | — |
| Relay — protects downstream | Yes | — | Yes |
| Bridge — transparent inline | — | Yes | Yes |
| How it enforces | |||
| Enforcement | Accelerated | RouterOS firewall | Accelerated |
| Older Linux versions | Supported | — | — |
| Whole-network filtering | Per host | To the router’s limits | Yes |
| Defence layers | |||
| Allowlist · blocklist · banlist · country | Yes | Yes | Yes |
| Gatekeeper trap ports | Yes | Yes | Yes |
| Flood protection | Adaptive + fixed limits | Fixed limits, IPv4 | Adaptive + fixed limits |
| IPv6 | Yes | Yes | Yes |
| Running it | |||
| Keeps filtering if the server is unreachable | Yes | Yes | Yes |
| Apps on the host can report attackers | Yes | — | Yes |
| Stays current | Signed self-upgrade | Automatic list sync | Signed self-upgrade |
A dash means not supported. Relay is not supported on RouterOS: the rules NuajProtect sets up there filter the forward chain, so a MikroTik covers downstream devices in Sentry or Bridge mode. Sentry is not supported on a NuajBridge, whose data path has no IP address of its own. Bridge is not supported on the Linux agent; transparent inline filtering runs on the appliance, on hardware we build and validate. Pairings are enforced when an endpoint is created.
Get started
Every type and placement lives in one account. Protect a server or a router today; the NuajBridge, coming soon, covers the whole network.