Skip to content
Book a demo
In development · early accessCentralized firewall

Write a network rule once and apply it everywhere.

orta already runs on your hosts and reads your clouds. Write a network rule once and it lands everywhere: nftables on Linux, Windows Firewall, AWS security groups and Kubernetes NetworkPolicies. Simulate first, then enforce.

Join early accessSee what ships today
1 rule
written once, compiled for every enforcement point
From real traffic
rules drafted from flows the agent already sees
Simulate
see what would break before anything does

Observe, draft, simulate, enforce.

  1. 01

    Observe

    The agent maps who talks to whom across hosts, pods and cloud resources.

  2. 02

    Draft

    Rules are proposed from the traffic you actually have: db only from app, nothing to the internet.

  3. 03

    Simulate

    Run a rule in audit mode and see every connection it would have dropped, with the process behind it.

  4. 04

    Enforce

    Publish once. orta compiles it for each target and reports what landed where.

Your network, segmented.

Allowed flows stay green, blocked ones go red, and the one rule nobody expected shows up before it hurts.

Rules by role

Write rules for roles like web, db and payments. Hosts and pods pick them up as they come and go.

Every enforcement point

nftables on Linux, Windows Firewall, AWS security groups and Kubernetes NetworkPolicies, from one rule.

Would-be violations

Audit mode lists the connections a rule would block before it blocks them.

Drift comes back

Change a rule by hand on a host and orta puts it back, and tells you who tried.

Process-aware

Let postgres on the db host reach the backup host, and keep everything else on that box out.

Evidence for segmentation

Network segmentation controls in PCI DSS, NIS 2 and ISO 27001, checked from the live rule set.

Built for what you run.

Enforces on

  • Linux
  • Windows
  • AWS
  • Kubernetes
  • Google Cloud
  • Azure
  • Terraform
  • nftables
  • Windows Firewall
  • Security groups
  • NetworkPolicy

Part of one platform.

Kubernetes network mapLive and dead connections between workloads, drawn today.
Runtime detectionThe same agent that enforces the rule sees what tries to break it.
Cloud postureOpen security groups are already flagged in AWS.

Centralized firewall is in development. This page shows where it is going; details will change as we build it with early-access customers. Today's product is on the platform pages.

NextZero trust network access

Want it first? Build it with us.

Early-access customers shape what ships: tell us what you run and what you need it to do.

Join early accessSee the platform