Web application firewall
Teichion
Early access
A self-hosted web application firewall that runs on your infrastructure.
Teichion is a self-hosted web application firewall: a Rust data plane, a Go control plane and a web console that run on your own infrastructure. Your traffic and TLS keys stay with you.
Problem addressed
Organisations that run their own infrastructure have to keep web traffic and TLS keys in-house, including those that maintain ModSecurity and OWASP CRS rule sets by hand today.
What Teichion does
Features
Deployment
- Self-hosted: a Rust data plane, a Go control plane and a web console.
Rules and detection
- Includes rules from OWASP CRS v4.0.0.
- Imports SecLang rules and lists the constructs it does not support.
- Inspects request bodies up to a size limit.
- Optional build that uses the Coraza engine.
- Per-policy rate limiting at the application layer.
Traffic and API controls
- JavaScript challenge, with CAPTCHA escalation using your own CAPTCHA provider account.
- Country and ASN rules using operator-supplied GeoIP databases, plus external reputation feeds.
- Imports an OpenAPI description and enforces its schema per route.
Policy lifecycle and operations
- Detection, blocking and disabled enforcement modes; policies are promoted between environments through approvals.
- Sends security events to your SIEM over syslog (CEF or LEEF) or Splunk HEC.
- Audit log with a built-in chain check you can run on demand.
- Lists noisy rules and lets operators apply exclusions.
- Single sign-on through your OIDC identity provider.
- Stores client IPs hashed, and redacts password, token, cookie and session values before storage.
How it works
A Rust data plane sits in front of your applications and inspects each request against the active policy. A Go control plane stores and compiles policies; data-plane nodes register with it and receive them. Operators work in a web console with role-based access and OIDC sign-in. It installs on Kubernetes from a Helm chart.
Who it is for
Teichion is for organisations that run their own infrastructure and have to keep web traffic and TLS keys in-house, including the teams that maintain ModSecurity and OWASP CRS rule sets by hand today. One organisation per install.
User guidance
Teichion documentation
User guide
Learn how to sign in, understand permissions, protect sites and APIs, investigate events, and manage approvals.
Operator guide
Operating the self-hosted console's rule management: rules from OWASP CRS v4.0.0, and the SecLang rule import that reports the constructs it does not support.
Contact
Talk to us about Teichion
Questions about Teichion? Email hello@phron.tech.