Open Source. Agentic. Transparent.

Tholian Firewall

Programmable eBPF Defense at Kernel Speed

Drop Threats Before the Stack

Tholian® Firewall blocks network traffic at the earliest possible point. Its eBPF and XDP programs drop matching packets at the driver receive path, before they can reach the operating system's networking stack.

There is no userspace detour, no rule interpreter in the hot path, and no external daemon required in the process that embeds it.

Programmable by Design

Traditional firewalls are configured out-of-band and force every decision through a different process. Tholian Firewall treats enforcement as ordinary code.

  • Forbid, permit, and check targets directly from a Go backend
  • Block IP addresses, CIDR subnets, TCP and UDP ports, ASN s, and domains
  • Apply rules from a compact scriptable CLI for operations and automation
  • Query the exact state of every filtered origin

The result is a firewall that behaves like a defensive primitive instead of a separate appliance.

An Agent You Can Embed

Every Tholian component is written like an agent, and the firewall is no exception. A Go service can embed it, enforce decisions inside its own process, and expose those capabilities to remote orchestration through explicit, auditable operations.

That makes kernel-speed filtering usable by autonomous cyber defense. Agents can observe, decide, and enforce without waiting for a human to edit a rule file.

Defense in Depth, Without Excuses

The firewall is verifier-safe by design. The kernel program is kept small and flat, while complex protocol work such as DNS answer extraction happens in Go where it is cheap and testable.

On platforms without eBPF, iptables , ip6tables , and /etc/hosts fallbacks keep protection available. The correct state about filtered origins is always reported, even when the underlying backend changes.

Open Source. Transparent. Verifiable.

Tholian is the only Agentic Cyber Defense solution that is built Open Source and remains transparent about what it can do. The kernel module, the Go bridge, the CLI, and the tests are available for inspection.

We document the limitations as clearly as the capabilities. No black box, no hidden rule engine, and no unverifiable claims about what the firewall can stop.

Deploy the Firewall