IngressGuard Gateway

TLS Interception Flow

Inspected Connection

TLS terminated · Content inspected · Re-encrypted to destination

Client → TLS 1 → IngressGuard → TLS 2 → Server

↕ Decrypted content flows through inspection pipeline ↕

Bypassed Connection

Financial · Healthcare · Certificate-pinned · Policy-excluded

Client → Pass-through → Server

Fast checks first. URL filtering executes before malware scanning — traffic blocked by category never reaches the expensive inspection layers.

URL filtering

Category-based and path-level URL filtering on decrypted HTTPS traffic. Block, allow, or log access by category, specific URL patterns, or custom rules. Full-path visibility requires HTTPS inspection — hostname-only filtering from SNI is available for bypassed connections.

Anti-malware inspection

Signature-based and heuristic detection scanning on decrypted response bodies — file downloads, inline content, and streamed data. Handles chunked transfer encoding, gzip/brotli content encoding, and multi-part responses transparently.

Intrusion prevention

Signature-based and anomaly-based detection on decrypted traffic. Identifies exploit payloads, protocol anomalies, and known attack patterns that would be invisible inside encrypted connections. Inspects both requests and responses.

Application-layer firewall

HTTP method control, header inspection, content-type enforcement, and request/response pattern matching. Block file uploads by type, enforce content security policies, and detect data exfiltration patterns at the application layer.

Network-layer firewall

Stateful packet inspection with port, protocol, and IP-based access control. Provides the network-layer foundation that the application-layer inspection builds upon — blocking unauthorized traffic before it reaches the content pipeline.

TLS 1.3 & cipher enforcement

Full TLS 1.3 support on both client-facing and server-facing sides. Enforces minimum cipher strength — refusing to negotiate weak or deprecated algorithms — acting as a cipher policy enforcement point that improves organizational TLS posture.

Threat dashboard HA failover Policy management Real-time alerts SIEM streaming Signature updates

TLS interception engine

Terminates client TLS, establishes server TLS, and manages the certificate substitution lifecycle. CA private key stored in hardware (HSM/TPM). TLS session caching and certificate caching minimize per-connection overhead. Full TLS 1.3 support.

Content inspection pipeline

Decrypted HTTP streams pass through URL filtering, anti-malware, IPS, and application firewall layers in sequence. Fast checks (URL category) execute before expensive checks (full malware scan). First blocking verdict terminates the connection.

Hardware acceleration

Asymmetric crypto (RSA/ECDSA handshakes, certificate signing) offloaded to dedicated hardware. Symmetric crypto (AES session data) uses AES-NI. Pattern matching for IPS and anti-malware can leverage GPU coprocessors on higher-tier models.