Firewall

QROS generates and deploys a real edge firewall on HAProxy: TLS termination with SNI routing, backend pools, and a filtering layer that drops known-bad clients before they reach your applications. Configuration is generated from your inventory and pushed over Ansible — no hand-edited haproxy.cfg, no drift.

QROS · Firewall · HAProxyedge-01

Frontends / backends

frontend fe_web bind :443 ssl crt /etc/haproxy/site.pem alpn h2 acl host_app req.ssl_sni -i app.banco.com use_backend be_app if host_app backend be_app balance roundrobin server app1 10.0.0.11:8080 check

Filtering rulesactive

Edge filters

Anti-Tor

Anti-Proxy/VPN

Anti-Bots

Anti-Scan

Block from IDS

Rate-limit API

92drop %

1.2M req/h · 14k dropped

HAProxy WAF generation

From each host in your inventory, QROS builds the HAProxy frontend (TLS bind, SNI ACLs, HTTP/2) and the backend pool (health-checked servers). Certificates are referenced from the PKI inventory so rotation is tied to post-quantum certificate issuance.

Filtering layer

Anti-Tor / Anti-Proxy / Anti-VPN — drop exits and anonymizers from published exit-node lists
Anti-Bots — challenge or drop known scanner/user-agent fingerprints
Anti-Scan — rate-limit and block port-scan behavior
Block from IDS — feed Suricata/Snort alerts straight into the firewall deny list

The same filtering engine powers the IPS; the firewall service is the pure edge-filtering deployment without the WAF rule set.

FAQ

Is this a network firewall (iptables/nftables)?

No. QROS deploys an application/edge firewall on HAProxy — TLS termination, SNI routing and L7 filtering. For host-level packet filtering you pair it with the CIS audit hardening playbooks.

How are rules kept up to date?

QROS regenerates the HAProxy config from your inventory and the latest block-lists on each deploy and pushes it over Ansible, so there is no hand-edited config and no drift between hosts.

Try this service with QROS

Explore now →