NuajProtect · NuajBridge

NuajBridge inline appliances

NuajBridge sits between your internet connection and your router and filters attacks out of your internet traffic, in both directions. It installs like a cable, has no address on the network it protects, and is managed from the cloud with your Linux servers and MikroTik routers. Two models are coming soon — for 2.5 and 25 Gb/s links — and both carry every protection.

POWERMGMTLAN2LANLAN1WANWAN
NuajBridge 2.5G · Compact, fanless
POWERON/OFFWANLANMGMTWANLAN
NuajBridge 25G · 1U rack unit

NuajBridge 2.5G · Measured

Proven on the bench.
Every protection on.

4.3Gb/s

Internet traffic, both ways at once

91% of the link, not a packet lost.

97%

Of a botnet DDoS attack stopped

0.71 Gb/s from 65,536 addresses at one of yours, while your traffic kept flowing.

99.8%

Of your traffic delivered during an attack

The lowest result across six different attacks, each run with everyday traffic flowing.

0

Packets lost or altered

Out of 671 million carried both ways under sustained load, each checked against what was sent.

A production NuajBridge 2.5G and separate test equipment, October 12 to 16, 2026. Full conditions in the product sheet.

The lineup

One appliance family.
Two link speeds.

Every model runs the same engine and every protection layer — nothing is held back for a bigger box. What a larger model buys you is a faster link.

NuajBridge 2.5G 25G
For Business internet links Service providers, data centres and campus edges
Link speeds it serves 2.5G · 1G 25G · 10G with SFP+ modules · 2.5G on its copper pair
Network ports Two 2.5 Gigabit Ethernet, RJ45 Two 25 Gigabit Ethernet, SFP28, and two 2.5 Gigabit Ethernet, RJ45
Management port One 1 Gigabit Ethernet, RJ45 One 2.5 Gigabit Ethernet, RJ45
Form factor Compact, fanless desktop 1U rack unit
Power USB-C Power Delivery AC, IEC C14 inlet
Performance Line rate from 256-byte packets, both ways — measured Measured before release
Availability Coming soon Coming soon
Every protection, on every model
DDoS and reflection attacks ✔ ✔
Zero-day attack signatures ✔ ✔
Port scans and brute-force ✔ ✔
Threat intelligence and geo-blocking ✔ ✔
DDoS reports, alerts and cloud dashboard ✔ ✔
NuajProtect subscription Included Included

The 2.5G figure is from a production unit on separate test equipment, every protection on, not a packet lost. The 25G is measured the same way before it ships, and its figures go here then. Your traffic will differ from any test: we size a deployment with you rather than have you infer it from a table.

Reserve a NuajBridge Help me choose

Downloads

Product sheets
and comparisons.

One PDF per model with its ports, protection and test results, and a one-page comparison against a firewall, a DDoS appliance and cloud DDoS protection.

NuajBridge 2.5G

NuajBridge 25G · Preliminary

Installation

Fits in front of
your router.

Internet, NuajBridge, your router, your network. Scan a code to claim it, cable it in, and it is protecting — no rules to write, no firewall to replace.

Transparent

An inline bridge

Your internet connection to the WAN port, your router to the LAN port. No change to your addressing, no proxy, no extra hop.

Invisible

Nothing to attack

The bridge has no address on the traffic it protects. It can’t be scanned, logged into or targeted from the internet.

Both directions

Every packet, in and out

Every packet in and out is inspected. Attacks it catches are dropped before they reach your network.

Out-of-band

Managed apart from your traffic

The management port plugs into your network behind the router, apart from the traffic it protects. It takes an address by DHCP and only connects out: no firewall rule to open.

Safe updates

Kept current, carefully

Threat feeds update continuously. A software update is kept only once the box is back up and forwarding.

Included

NuajProtect in the box

Every NuajBridge ships with a NuajProtect subscription: the threat feeds, the cloud dashboard, reports, alerts and updates.

Protection

Protection
in layers.

DDoS

Attacks, large and small

Per-source rate limiting stops loud attackers. An address under attack is held to its own normal rate, and an adaptive rate limit caps the rest; replies to your own connections are let through.

Reflection

Reflection and amplification

Replies from DNS, NTP, memcached and similar services pass only when a device on your network asked for them.

Zero-day

New attacks, signed on the spot

It learns your normal traffic and writes an attack signature that blocks only what sets the attack apart.

Probing

Port scans and brute-force

It watches the ports your services listen on and blocks sources that keep failing to connect.

Threat intelligence

Known threats, blocked

Curated threat feeds, your own blocklist and geo-blocking, for IPv4 and IPv6.

Community

Stronger together

When one NuajBridge catches an attacker, every network in the NuajProtect community blocks it, often before it reaches yours. You choose who you share with and how many separate devices must report an attacker first.

Visibility

See every threat,
and why it was stopped.

A DDoS attack report: 45 minutes, 1.04 billion packets blocked, your traffic through the attack, and the networks it came from A DDoS attack report: 45 minutes, 1.04 billion packets blocked, your traffic through the attack, and the networks it came from

Every attack, reported

After each DDoS attack: what came, from which countries and networks, what was blocked and learned. By email, text or a daily digest.

Compromised devices

An alert when your network keeps trying to reach listed addresses, a sign of an infected device; that traffic is blocked.

Why, for any address

Live traffic, an activity log, and a lookup that says why any address was blocked or let through.

Limits

What it can’t do.

Stop attacks bigger than your link

They fill your internet link before they reach the box. Those need your internet provider.

Single out DDoS traffic that looks like yours

It is held to the rate limit: your connections carry on, but new visitors to a public server may be dropped too.

Block reflection with asymmetric routing

Reflection blocking needs to see requests going out. If outbound traffic takes another path, turn it off.

Questions

Before you reserve one.

When can I get a NuajBridge?
The 2.5G and 25G models are coming soon. Join the NuajProtect beta and you get priority access to each model as it ships; to reserve one, or to size a deployment, write to sales@nuaj.com.
Do I have to change my network to install it?
No. Your internet connection goes into the WAN port and your router into the LAN port. Nothing is readdressed, there is no proxy and no extra hop, and the bridge has no address on the traffic it protects. Its management port plugs into your network behind the router, takes an address by DHCP and only connects out, so there is no firewall rule to open.
Which model do I need for a 10 Gb/s link?
The NuajBridge 25G. Its SFP28 ports take 10 Gb/s SFP+ modules, so the same box serves a 10G link today and a 25G link later.
Can NuajBridge stop an attack bigger than my internet link?
No, and no box on your side of the link can: such an attack fills the link before it reaches the box, and that needs your internet provider. NuajBridge stops what arrives over your link, in both directions.
Is a NuajProtect subscription included?
Yes. Every NuajBridge ships with NuajProtect included: the threat-intelligence feeds, the cloud dashboard, DDoS reports and alerts, and updates.

Protecting a single server or a MikroTik you already run? The same account manages NuajProtect on Linux and NuajProtect on RouterOS, and you can start there today.

Coming soon

Be first
in line.

Beta members get priority access to each NuajBridge model as it ships. Join now and protect your servers and routers in software while you wait.

Join the beta Reserve a NuajBridge