Packet filtering
Rules are compiled into nftables sets and applied in the kernel.
Decisions happen before a request ever reaches a web server or an application.
CDPGuard ·
PowerFirewall
A firewall that is part of the server, not a box in front of it.
CDPGuard filters packets, recognises attack patterns and blocks them while they are still happening.
It reconciles its rules on every start, so a server never comes up unprotected.
Scope
One job, done properly.
CDPGuard is a firewall.
It is not an audit service, not a scanner and not a consultancy —
those are CyberGuard, a separate division.
This product filters traffic.
Pattern detection
Login floods, path probing, known scanner signatures and protocol abuse are recognised as they happen and answered immediately.
Real timeAutomatic blocking
An offending source is added to a block set with a lifetime.
Repeat offenders escalate;
sources that stop are released again.
State that survives a reboot
The rule set is rebuilt from its own definition on every start.
Nothing depends on a rule that happened to still be loaded.
Capabilities
What the firewall does for a CDP server.
- Rule reconciliationThe active rule set is compared with its definition on every start and after every change.
- Rate limitingPer source and per target, for login endpoints, forms and API paths.
- Block sets with lifetimeTimed blocks with escalation for repeat offenders and automatic release.
- Allow listsYour own addresses, monitoring probes and the CTPF network are never locked out.
- Port policyOnly the ports a server actually serves are open; everything else is closed by default.
- Protocol hardeningMalformed packets, spoofed sources and abusive connection patterns are dropped early.
- Security eventsEvery decision is an event with source, reason and time — visible in ControlDeskPanel.
- Per-site rulesA vhost can carry its own limits without affecting the rest of the server.
- LicensingCDPGuard is a separately licensable module of ControlDeskPanel.
The facts
Where it sits.
No vague performance claims here —
these are the properties of the design.
nftablesRules applied in the Linux kernel
CDPModule of ControlDeskPanel
0Extra appliances or third-party clouds
Every bootRule set reconciled from its definition
27,600IP addresses currently blocked
Principles
Six rules the firewall follows.
Closed by default
A port is open because a service needs it, never because nobody closed it.
Decide early
The cheapest request to serve is the one dropped in the kernel.
Blocks expire
A timed block with escalation beats a permanent list nobody maintains.
State is derived
The running rule set is rebuilt from its definition, not patched by hand.
Every decision is an event
If it cannot be seen in the panel afterwards, it did not happen.
Firewall only
Audits, monitoring and compliance are CyberGuard’s work, not this product’s.
CTIAD
Detection here. Intelligence next door.
CDPGuard detects and protects the systems it is attached to.
CTIAD is the central threat-intelligence and abuse database: it collects, correlates, scores and reports.
The blacklist is one module inside that database, not the product itself.
- CTIAD to CDPGuardThreat intelligence and scored abuse data are there so protection can use them. CDPGuard does the detection and the blocking.
- CDPGuard to CTIADWhat CDPGuard observes — abuse and threat events — is the material CTIAD is built to store, correlate and turn into intelligence.
- Not a blacklist with a new nameA published list is an output of CTIAD. The database is the system. External catalogues such as AbuseIPDB are comparison context, not this architecture.
CDPGuard ships with the CDP platform.
Licensed as a module of ControlDeskPanel, operated by CertThor PlatForms Ltd.