TotalHealFireWardenNext-Generation Firewall (NGFW)
The firewall of every office, on BranchEdge appliances you manage from one console: rules by application and person, threat intelligence, IPS, HTTPS inspection, antivirus on downloads, and a cloud firewall for branches.
Trial: 30 days, up to 2 appliances. You sign in to the TotalHeal console with a Sttiz account and activate FireWarden NGFW. No card.
Branch firewalls are bought one by one, configured one by one and forgotten: rules nobody remembers adding, a different policy at every site, threat intelligence that never reaches them, and a change made at night that cuts the office off until someone drives there.
FireWarden runs on TotalHeal BranchEdge appliances — any Linux box with two or more ports, set up with one installer command — and every appliance runs the same policy from the TotalHeal console. Each change is compiled for each appliance, versioned, and applied in one transaction; an appliance that cannot reach the cloud after a change goes back to the last good policy on its own after five minutes.
FireWarden NGFW, feature by feature.
Rules by what and who
Ordered rules by zone (WAN, LAN, guest, the other offices), address and service objects, applications — 31 built in, from Microsoft 365 and Zoom to BitTorrent and Tor, recognised by the names they resolve, their address ranges and ports — and people’s groups, from who signed in through NetworkGate and SurfGuard groups.
Threat intelligence both ways
Every active IP indicator from your TotalHeal threat intelligence is blocked in and out on every appliance; add your own addresses with a reason. SYN-flood and connection limits per address stop simple floods.
Know what each rule does
Each rule has its own hit counter on every appliance, summed in the console; rules at least 30 days old that matched nothing for 30 days are listed as unused.
IPS
On the Professional tier, Suricata inspects the traffic of rules you mark — detecting and alerting, or blocking — with TotalHeal rules (EICAR, Log4Shell, path traversal, PowerShell download cradles, SSH brute force …) and your own Suricata rules. Alerts arrive in TotalHeal with the source, target and signature.
HTTPS inspection
On the Professional tier, allow rules marked Decrypt send web traffic through an inspection proxy on the appliance that presents certificates from your organisation’s TotalHeal root and checks each site’s real certificate. Online banking and the categories and domains you exempt pass through untouched.
Antivirus in transit
On the Elite tier, files people download — programs, archives, documents — are checked with ClamAV on the appliance before they are delivered; malware is replaced by a page naming it and raises a high alert.
Cloud firewall for branches
A branch can send its internet through the tunnel to a hub appliance — in the TotalHeal cloud or your data centre — where FireWarden decides and takes it out, so small offices need only a basic box.
Safe changes
On the Professional tier a policy change can wait for a second administrator; every version is kept, an appliance can be pinned to an older one, and an unconfirmed change can be rolled back from the console.
How FireWarden NGFW works.
FireWarden runs the same policy on every BranchEdge appliance: rules by application and person, threat intelligence both ways, IPS, HTTPS inspection and antivirus on downloads, with every change versioned and rolled back automatically if an appliance loses the cloud.
- InstallTurn any Linux box with two ports into a BranchEdge appliance with one installer command.
- PlaceGive it a site and its ports — or register its serial number and let it set itself up.
- WriteWrite one policy: rules, applications, groups, IPS, inspection.
- ApplyEach appliance gets its compiled version within 30 seconds, applied in one transaction.
- WatchHit counts, blocks and IPS and malware alerts arrive in the console.
Platforms and deployment
Platforms
| Platform | How it is covered |
|---|---|
| Appliance | Any x86-64 or arm64 box with two or more network ports, Debian 12 or Ubuntu 22.04+ (hardware, virtual machine or cloud instance) |
| Data plane | nftables (one table, applied in a single transaction), Suricata for the IPS, ClamAV for files in transit |
| Console | TotalHeal web console: FireWarden and FleetControl |
Deployment
| Profile | Status |
|---|---|
| SaaS | AvailablePolicy and FleetControl in the TotalHeal cloud; appliances at your sites. |
| On-premises control plane | AvailableDelivered with our team from the on-premises kit. |
| Air-gapped | AvailableOffline kit, offline licence file and offline update bundles. |
Essential, Professional or Elite.
Priced per appliance per year. Counted: branchEdge appliances running FireWarden.
| Feature | EssentialUS$240per appliance per year | ProfessionalUS$420per appliance per year | EliteUS$600per appliance per year |
|---|---|---|---|
| Stateful rules by zone, address and service objects, applications (domain, address and port) and people’s groups; NAT and port forwards | |||
| TotalHeal threat intelligence blocked both ways; SYN-flood and connection limits; your own blocked addresses | |||
| Hit count per rule, unused-rule report; every policy version kept; automatic roll-back when an appliance loses the cloud after a change | |||
| Cloud firewall: branches’ internet through a hub appliance (TotalHeal cloud or your data centre) | |||
| IPS (Suricata) in detect or block mode with TotalHeal rules and your own; alerts in TotalHeal | |||
| HTTPS inspection with exempt categories (online banking by default) and domains | |||
| Country blocking; policy changes approved by a second administrator | |||
| Antivirus on files in transit (ClamAV); malware blocked with a page and an alert | |||
| Blocks from TotalHeal responses reach the appliances; high-availability pairs (VRRP) |
List prices per appliance per year; minimum 1 appliance. Each tier includes everything in the tier before it. Volume, multi-product and partner pricing on request.
FireWarden is sold on its own, per appliance; FleetControl is included.
Government profile. Government is a profile, not a separate tier or price list: the Elite tier with Government defaults switched on — data residency in India, four-eyes approval of policy changes, a distinct approver for every approval-level action, retention of at least 180 days, and the CERT-In and DPDP reporting clocks.
What you need
- A BranchEdge appliance at each site (installer: --branchedge, with --with-ips and --with-av for the IPS and antivirus)
- The TotalHeal root trusted on devices for HTTPS inspection
Procurement documents for FireWarden NGFW
The datasheet is public. The full dossier is sent on request, so we can match it to your tender.
- Datasheet. What the product does, platforms, deployment profiles, tiers and honest limits.
- Compliance matrix. Each requirement marked comply, partial or no, with an evidence reference — CERT-In directions, DPDP, ISO 27001 controls touched, accessibility of the console, data residency.
- Bill of materials. SKUs per sizing, the unit and quantity formula, customer-side components and services.
- Architecture and hardening. How the product is deployed and the hardening guidance for each component.
- SLA. Support tiers, response targets the team can meet, update cadence and end-of-life policy.
- OEM authorisation letter. A MAF template for resellers and system integrators, with product names exactly as on the SKU.
Works well with
Get a quote for FireWarden NGFW.
Tell us how many appliances you need and how you want to deploy. We reply with a quote and the procurement documents you ask for.
Or email business@totalhealsecurity.com.