TAPGW

The gateway
that taps itself.

TAPGW sits between your internal network and everything untrusted. It NATs. It filters by port and protocol. And it copies every packet to one or many IDS sensors over VXLAN.

Watch the traffic How it works
Live topology Full path
0 forwarded 0 tapped 0 blocked
VXLAN Sensor 01 IDS / NDR
VXLAN Sensor 02 IDS / NDR
VXLAN Sensor 03 IDS / NDR
TAP copy · VXLAN
Trusted Internal 10.0.0.0/8
TAPGW
Firewall · NAT/PAT · TAP
Untrusted Internet 0.0.0.0/0

Packets cross TAPGW like any NAT gateway — then a perfect copy rises to your sensors.

  • HTTPS
  • DNS
  • SSH
  • NTP
  • Blocked

Replace a firewall, a TAP, and a packet broker with one simple gateway.

How it works

Three jobs. One box.

The path is the explanation. Inside to TAPGW to the internet. Traffic is translated, filtered, and copied to your sensors on the way through — three jobs that used to live on three boxes.

  1. 01

    Gateway

    Internal hosts reach the untrusted network through TAPGW. Source addresses are translated with NAT/PAT. Return traffic lands back where it belongs.

  2. 02

    Firewall

    Port and protocol rules decide what is forwarded and what is blocked. Simple. Predictable. No policy novel required to ship a change.

  3. 03

    TAP over VXLAN

    Every packet that hits TAPGW is copied, encapsulated in VXLAN, and sent to one or many IDS sensors. Your existing detection stack just works.

Capabilities

Basic gateway. Serious visibility.

NAT / PAT

Hide the internal network behind a translated address. High-port PAT for many-to-one, or 1:1 when you need it. Standard gateway behavior — on purpose.

Port & protocol firewall

Allow or deny by port and protocol. Blocked sessions never leave the box. Sensors can still see the attempt, so security is not blind to what you refused.

Inline TAP

A full-fidelity copy of traffic, taken at the gateway as packets pass through. Forwarded or blocked, the copy still goes out over VXLAN.

VXLAN fan-out

Copies are routable overlay. Send them to a sensor on the same rack, or to many sensors across the environment. Add a collector without touching the forwarding path.

Works with your IDS

Suricata, Zeek, NDR — TAPGW does not replace them. It delivers a VXLAN copy they can listen to, so detection stays on the stack you already run.

One appliance

Fewer devices in the critical path. Fewer things to patch, rack, and explain. Simple enough to operate. Serious enough to trust with the edge.

Two rooms, one story

Network gets a gateway.
Security gets the wire.

For network teams

It behaves like the box you already understand.

  • Internal on one side, untrusted on the other
  • NAT and PAT for outbound and return traffic
  • Port/protocol rules with an obvious outcome
  • No hairpin through a broker just to reach the internet

For security teams

It copies every packet that hits the box.

  • Every packet copied, not sampled
  • VXLAN to Suricata, Zeek, NDR — whatever you run
  • Blocked attacks are still visible to sensors
  • Fan-out to one sensor or a whole detection farm

Architecture

As simple as it looks.

Internal network connects down into TAPGW. TAPGW connects down to the untrusted network. From TAPGW, tapped traffic goes to one or many IDS sensors over VXLAN.

Traffic flows through TAPGW as a gateway. A copy of that traffic is encapsulated in VXLAN and delivered to whatever sensors you already operate. Nothing about your IDS has to change except where it listens.

Secvara

Simple on purpose.

TAPGW is part of Secvara’s simple software solutions — networking technology that a room of executives can understand in one sitting, and a network team can actually run.

hello@tapgw.com