OmniWall
Security & Infrastructure · Available · v1.0
OmniWall is an autonomous defense mesh: Layer 7 Coraza WAF as Traefik ForwardAuth, bare-metal Go enforcement daemons (MailSentinel/Milter, OmniWall daemon at host-net with NET_ADMIN), .NET C2 API with threat-intel, ComSec BEC relay, RansomGuard EDR, OmniSense normalisation and mail proxy. Includes OmniWall MailProxy — an invisible local mail proxy between Sage/Outlook and M365 that fingerprints invoices (SHA-256 ledger), attaches verification badges and auto-protects via 3-tier model: Tier0 external badge, Tier1 password-ZIP, Tier2 Razor .bdna + AES-GCM for verified partners. Fail-closed lattice, honey-ports, YARA, closed-loop L7→L3 ipset.
Business problem
Invoice BEC (altered bank details on PDFs), ransomware and automated exploitation traverse email and network perimeter because detection lives abroad and enforcement is decoupled.
Core capabilities
- ▸Coraza WAF (Traefik ForwardAuth /verify, L7→L3 ipset closed loop)
- ▸Go enforcement daemons (host-net, command pipeline incl. QuarantineFile)
- ▸MailProxy: SHA-256 invoice ledger, verification badge, 3-tier ZIP/.bdna/AES-GCM, MIME deflate/inflate per-part SHA, IMAP/POP3/SMTP gates
- ▸Threat-intel API (rules, time windows, categories, IPS sigs)
- ▸ComSec BEC ledger/portal/vendors
- ▸RansomGuard EDR + YARA + honey-ports
- ▸SOC SignalR hub + ingest workers
Architecture
WAF verifies at L7 then closes loop to ipset at L3; mail daemons tap host net; MailProxy sits on loopback (1143/1110/1025) between MUA and upstream, with per-part SHA verification and local CA tooling per OS.
Deployment: On-prem / self-hosted appliance + cloud C2; zero-plugin — point MUA to 127.0.0.1.
Licensing: Per-seat / per-gateway + support; POPIA in-country.
Evidence & confidence
Confidence: high
- MOBISEC-Portfolio-Executive-Summary.md §7 (Production)
- OmniWall MailProxy.pdf executive summary (3-tier, fail-safe, Zero-Plugin)
- D:\MobiseCloud\Projects\OmniWall\README.md — layout table
At a glance
- Platforms
- Linux (Go daemons) · Windows / Android sentinels · Mail: IMAP/POP3/SMTP
- Stack
- .NET 8 C2 API + EF Core (schema omniwall) · Go / eBPF + Coraza v3 + CRS · Traefik ForwardAuth · Razor 10.1.0 (.bdna) · PostgreSQL + Redis · Docker / Coolify
- Integrations
- Razor compression · omnigrid · OmniTrust Identity · Eureka · M365 / Exchange
- Maturity
- Production (high confidence)
Target customers
- · SMEs running Sage + M365
- · Enterprises needing on-prem WAF + EDR
- · Schools, clinics, municipalities
Roadmap
Additional YARA packs, mail-port bypass hardening (report 8.6 closure), Scout-trapping expansion.