Platform
One operating system. Every defence.
El Cubo is a router operating system. Filtering, intrusion prevention, download scanning, VPN, segmentation and updates live in the same place the packets do, so every decision is made once, on the box, now.
Names
Blocked at the first question.
Every name a device asks for passes through El Cubo before it is answered. Whole categories of the internet can be switched off with one tick, your own allow and block lists sit on top, and a longer allow always wins, so one useful corner of a blocked site keeps working.
- Dozens of categories, tens of millions of names, refreshed every day
- Enforced on the name and again on the handshake, so a device that resolves elsewhere is still refused
- Encrypted DNS, hidden resolvers and the usual bypass tricks are closed by default
- A blocked site lands on the box's own policy page, not a browser error
Intrusions
Patterns the packets can't hide.
Traffic that crosses the box is inspected in the flow. Exploits, scanners, command channels and the beacons of a compromised machine are dropped before they land, and everything the engine sees is written down so a person can read what happened.
- Block mode drops what it recognises; alert mode watches and lets you decide
- A device caught talking to a command server is quarantined on the spot
- Sized to the box it runs on, from a small device to a server
- Designed so that a security feature can never take the network down
Downloads
Every file, judged as it arrives.
Documents, installers, scripts and archives are read as they download and judged by models that run on the box. A malicious file is stopped before it reaches a desk, and the person who asked for it sees a page that says why, in words anyone can understand.
- Verdicts in milliseconds, with a plain-language explanation for every one
- Compression bombs, encrypted archives and oversized files handled by policy
- Devices that must stay untouched can be exempted by address
- Nothing leaves the network to be judged; the intelligence is on the box
Tunnels
Every device. Every place. One key.
Laptops, phones, branch offices and clouds join the protected network with the VPN clients their operating systems already ship. Nothing to write, sign or install, and every remote device gets the same filtering, inspection and scanning as a desk in the office.
- Modern kernel VPN for people, with a profile downloaded from the console
- Native clients on Windows, Mac, iPhone, Android and Linux
- Site-to-site tunnels join another office or a cloud network as one LAN
- Each person is one device, one address, one line in the log
Network
A real router underneath.
Zones, VLANs, policies, static routes, multiple WAN links, PPPoE, DHCP and addressing: the plumbing of a serious network, configured from one place with every change confirmed, so a mistake rolls back before it strands anyone.
- Zones and policies that read as sentences, not matrices
- Timed confirmation on every change that could cut you off
- Per-device logs of names, flows and verdicts, kept on the box
- Backup, restore and factory reset for a fleet or a single device
Updates
It updates while it routes.
A new release is written beside the one that is running, with no service stopped. The switch costs one reboot, taken when you choose. A release that fails to come up is abandoned for the one that worked, without anyone driving to the site.
- Two slots, one always known good
- Automatic fallback, proven in both directions
- A bad configuration reverts by itself; the box can never lock you out
- Signed releases for the system and for the models
Console
One configuration. Validated as you type.
The whole box is one readable configuration. The console checks it as you write and names the setting at fault in plain words. A configuration that would not load cannot be saved, so the box is never one typo from silence. A fleet is managed the same way, from one place.
- Error messages a person can act on, guaranteed, not hoped for
- Served by the box itself: light, fast, nothing fetched from outside
- Management plane over its own protected tunnel
- Command line with the same controls for people who prefer it
Where it runs
A device, a VM, a cloud, a Mac.
The same operating system, the same image family, from a palm-sized device to a cloud instance. A very light footprint: a small download that runs in a fraction of the memory a legacy appliance needs.
- arm64 hardware
- amd64 hardware
- VMware ESXi
- KVM and Proxmox
- Cloud droplets
- USB and ISO
- A VM on a Mac