Derbend-HUB
Sign inOpen an account

Derbend UTM · Derbend Guard · Derbend Hub

Centrally managed network and server security.

Derbend UTM combines firewall, user access management, content and application filtering and reporting in one appliance. Derbend Guard enforces rule-based inbound filtering on cloud servers. Both are deployed, monitored and updated from Derbend Hub.

Create an accountExplore the products

Products

The Derbend product family

Derbend UTM protects the organisational network; Derbend Guard protects cloud servers. Both share one account, one deployment method and one management interface.

UTMAvailable

Derbend UTM

Unified threat management (UTM) firewall for campus, school, organisational and guest networks.

Network

  • Multi-WANMultiple internet lines with health monitoring and automatic failover to a standby line.
  • LAN, VLAN and DHCPNetworks, DHCP reservations, per-interface rules, NAT and port forwarding in one interface.
  • Wi-Fi access pointWith a compatible wireless card, the appliance also serves as a wireless access point.
  • Traffic priorityVoice and video calls are prioritised over bulk downloads.

Access

  • User Access PortalSelf-registration, SMS verification and optional administrator approval for guest users.
  • Groups and quotasPer-group time windows, daily data quota, speed and device limits; portal exemption by MAC address.

Protection

  • Web filterCategory-based and custom-list web filtering, HTTPS included, with no certificate on user devices.
  • Application filterAn application catalogue grouped by kind; applications are blocked by group or individually.
  • VPN and proxy blockingBlocking of VPN, proxy, encrypted DNS and hidden VPN connections, with an exemption for the corporate VPN.
  • Intrusion preventionInline intrusion prevention; reporting of devices that contacted dangerous addresses.

Visibility

  • Live sessions and reportsPer-user live sessions, speed and quota; access and application reports with CSV and PDF export.
  • Law 5651 access recordAccess records under Turkish Law 5651; default retention two years.

One Linux server · approx. 500 devices · Debian or Ubuntu

GUARDAvailable

Derbend Guard

Inbound traffic firewall for Linux servers in the cloud; rules are defined in Derbend Hub.

Rules

  • Allow rules onlyAll new inbound connections not allowed by a rule are blocked; outbound traffic is unaffected.
  • SSH access restrictionSSH is defined as open to all or to at least one static IP address.
  • Draft and applyRule changes are prepared as a draft and applied to the server on confirmation.

Extra Protection

  • Bad-IP listConnections from IP addresses known for abuse are blocked.
  • Port scan blockingSources performing port scans are blocked for a set period.
  • Web scan blockingScanners probing a website for .env, .git and the like are recognised in the access log and blocked.
  • SSH attempt limitFailed SSH attempts are limited per address.

Visibility

  • Connection logAllowed and blocked connections are retained for seven days, with the busiest sources and ports.
  • ResourcesOptional CPU, memory, disk and network traffic monitoring.

Upkeep

  • One-command installRuns as a single service with no additional components.
  • Updates from the hubThe agent updates automatically from the selected release channel.

Debian or Ubuntu · amd64 or arm64 · single service

Derbend Hub

Central management

All UTM and Guard devices are managed under one account, protected by mandatory two-factor authentication.

  • Device inventory and status monitoring
  • 90-day performance history
  • Remote access by domain name for every device
  • Release channels and automatic updates
  • Configuration backup
  • Access sharing with team members
  • Fault notifications
  • Mandatory two-factor authentication

Screens

Product screens

The Derbend UTM management panel and Derbend Hub's device, Guard and rule screens.

The Derbend UTM dashboard: 963 devices, 5.66 Gbit/s on the WAN line, system health, services and the hub link.

1 / 5

Screens from our lab, filled with demo data.

Open the live Derbend demoOpen the live Guard demo

Derbend UTM

Derbend UTM features

Firewall, user access portal, content filtering and reporting in one appliance.

Multi-WAN and network management

DHCP, static and PPPoE lines are used at once; line health is monitored and traffic fails over automatically to a standby line. LANs and VLANs, DHCP reservations, per-interface firewall rules, NAT and port forwarding are managed from one interface. Undeletable access rules keep the management panel reachable from the local network.

D

User access management

Self-registration through the User Access Portal, SMS verification and optional administrator approval. Authorisation is per device; groups are given time windows, a daily data quota, speed and device limits. Televisions, printers and cameras that cannot sign in are exempted by MAC address.

Dhoursquotaspeed

Content and application filtering

Ready-made categories, custom lists, application blocking and security address lists. Encrypted DNS, VPN and proxy connections are blocked so the filter cannot be bypassed. Filtering does not decrypt traffic; no certificate is installed on user devices.

D

Reporting and logging

Per-user live sessions, speed and quota. Access and application reports are exported as CSV and PDF. Devices that contacted dangerous addresses, and whether they were blocked, are reported per device.

Derbend UTM

Application filtering

The application catalogue is grouped by kind. In each network's filter profile, applications are blocked by group or individually. Web applications are identified by their domains; protocols such as BitTorrent and Tor by their traffic signatures.

Social media

  • Instagram
  • TikTok
  • Facebook
  • X
  • Snapchat
  • Reddit
  • LinkedIn
  • Pinterest
  • Threads
  • Bluesky

Messaging and meetings

  • WhatsApp
  • Telegram
  • Signal
  • Discord
  • Microsoft Teams
  • Zoom
  • Google Meet
  • Slack
  • Viber
  • WeChat

Video and TV

  • YouTube
  • Netflix
  • Twitch
  • Kick
  • HBO
  • Apple TV+
  • Vimeo
  • Dailymotion
  • DAZN

Music and radio

  • Spotify
  • SoundCloud
  • Deezer
  • Tidal

Games

  • Steam
  • Roblox
  • Epic Games
  • PlayStation
  • Xbox
  • Riot Games
  • Battle.net
  • EA

VPN and proxy

  • NordVPN
  • Proton VPN
  • Surfshark
  • Mullvad
  • Cloudflare WARP
  • Private Internet Access
  • Tor
  • Tailscale

Peer-to-peer (P2P)

  • BitTorrent

Remote access

  • AnyDesk
  • TeamViewer
Every feature of Derbend UTMThe features an organisational network needs, in one appliance with no add-on modules.

Network and routing

  • Multi-WAN: DHCP, static and PPPoE uplinks
  • Link health checks and automatic failover
  • LANs and 802.1Q VLANs, with the uplink chosen per network
  • DHCP server with MAC-to-IP reservations
  • Per-interface firewall rules, automatic outbound NAT, port forwarding
  • Anti-lockout rules that cannot be deleted
  • Local DNS resolver, or forwarding to your own DNS servers
  • Its own Wi-Fi access point, on a card that supports it

Hotspot and user access

  • Captive portal, switched on per network
  • Self-registration with SMS one-time code verification
  • Admin approval queue
  • Access bound to the device's MAC and IP pair
  • Groups: time windows, daily data quota, speed limit, device limit, timeouts
  • Portal exemption by MAC for TVs, printers and cameras

Web filtering and application control

  • HTTPS filtering without decrypting traffic: no certificate on users' devices
  • One list enforced at both the DNS and the packet layer
  • Categories set to allow, watch or block, in filter profiles per network
  • Your own lists by domain, regex, IP or keyword, and an exception list
  • Application blocking: web apps by domain, BitTorrent and Tor by DPI signature
  • VPN and proxy blocking: hosting networks, known VPN and Tor exits, protocol fingerprints — with an exemption for your own VPN
  • Hidden VPN detection, with the servers found shared between Derbends
  • Encrypted DNS enforcement: DoH, DoT and QUIC blocking, ECH neutralised
  • A domain test tool, and a one-click report of a wrong entry

Intrusion prevention (IPS)

  • Inline IPS that inspects the start of every new connection and leaves the rest at full speed
  • Signature sets: the threats aimed at the devices behind the box by default, any category on request
  • Threat address lists from several well-known sources, refreshed on their own
  • Per-device threat contact: who reached a blacklisted address, and whether it was stopped
  • Switched on per network; if the engine stops, the network keeps running and the panel warns

Traffic shaping (QoS)

  • Each line's real speed, with modern queue management against bufferbloat
  • A traffic-type catalogue: calls and video first, bulk downloads last
  • A screen showing which queue the traffic actually landed in

Reporting and logging

  • A dashboard of traffic, threats, line health and system health
  • Live sessions with each user's speed and quota
  • Who went where: passed, blocked, no reply or refused
  • Per-application summaries, exported as CSV or PDF
  • An access record for Turkish Law 5651, kept two years by default, any range downloadable
  • A live firewall log, searchable thirty days back

Management

  • Every network change checked and snapshotted, and rolled back if not confirmed within 60 seconds
  • Backup and restore, with a copy of the configuration on the hub
  • Automatic updates on the stable, beta or alpha channel
  • Checkup: the whole path a device's traffic takes, tested in one press, with traceroute and a speed test
  • A web terminal in the browser, recorded in the audit log
  • API keys, with the API reference in the panel
  • Sign-in with your hub account; sign-in from the internet behind a Cloudflare challenge

Derbend Guard

Derbend Guard features

Inbound traffic on cloud servers is filtered according to rules defined in Derbend Hub.

Allow-based rule model

Permitted sources are defined per port; all other inbound connections are blocked and logged. At least one static IP address is required for SSH access; rule sets that would cut off access are rejected before they are applied.

Extra Protection

Per-server protections against scanners, repeated attempts and known attacker addresses. All are off by default; addresses named in the rules are never caught, and the log shows which protection blocked each connection.

  • Bad-IP list
  • Scan ban
  • SSH attempt limit
  • Web scan

Derbend Hub

Derbend Hub features

Status, version, load and connected device count of every device, monitored in one list.

Dhubstatus, every 2 minutesDDD

Requirements

System requirements

Both products run on existing hardware or virtual servers.

Derbend UTM

MinimumStandardRecommended
RAM4 GB8 GB12 GB
vCPU246
Disk20 GB40 GB100 GB
  • Debian or Ubuntu on a server dedicated to Derbend; validated releases are Debian 13 and Ubuntu 26.04.
  • Two network interfaces (WAN and LAN), or one interface as a VLAN trunk.
  • Installation does not start below the minimum. The standard configuration is what Derbend is sized for; the recommended one holds every filter list in the local resolver.

Derbend Guard

  • Ubuntu 20.04+ or Debian 11+, amd64 or arm64.
  • A single service and the operating system's packet filter; no additional components.
  • Only inbound traffic is filtered; the server's outbound connections are unaffected.

Getting started

Deployment steps

Three steps from account creation to the first device in service.

  1. 01Create an account with your e-mail address and enable two-factor authentication.
  2. 02You are notified by e-mail once the account is approved.
  3. 03Select Add, choose UTM or Guard and run the given command on the server; the device is added to your list.
Open an accountSign in