Network firewall overview

Goal

Understand ShieldGate’s Network firewall (appliance) plane before you change zones, routes, or firewall rules.

Prerequisites

• Admin console access with at least network.read.
• Optional: a running ShieldGate.Appliance node (Mock datapath is fine for learning).

Three planes

Plane	Hosts	Role
Control	Api, Web, Worker	CRUD, publish, audit for WAF and network
Proxy	ShieldGate.Proxy	HTTP reverse proxy + WAF
Appliance	ShieldGate.Appliance	L2/L3 packet path: interfaces, firewall, NAT, VPN, services

Network changes use a separate NetworkConfigSnapshot and Redis channel (shieldgate:network:{tenantId}). They never mix into the YARP/WAF tenant snapshot—so you can publish WAF or network independently.

Where to click

Open Network in the sidebar. Sections map to ?section=:

Section	Covers
Overview	Summary, publish
L2	Zones, interfaces, VLANs, bridges
L3	Addresses, static routes, ECMP
Firewall	Zone-based firewall rules
NAT / PBR	NAT and policy-based routing
VPN	WireGuard / IPSec tunnels
Services	DHCP scopes, DNS forwarders
Dynamic	OSPF areas, BGP neighbors
WAN / QoS	SD-WAN and QoS policies
HA / Monitor	Clusters, nodes, apply status
Settings	IP forwarding, eBPF flags, versions, rollback

Permissions

Permission	Use
network.read	View configuration
network.write	Create / update / delete resources
network.publish	Publish and rollback snapshots
network.monitor	Monitoring nodes and apply status

Config lifecycle

1. Edit resources in the console (or /api/v1/network/...).
2. Publish from Overview (requires network.publish).
3. Appliances pull the new version and reconcile via the Network Engine (Mock or Linux datapath).
4. Check HA / Monitor for apply status; use Settings to roll back if needed.

Verify

• You can open Network → Overview without a 403.
• You know network publish is separate from Ops → Config (WAF) publish.

Next

Continue with Zones and L2.