VeilNet
VeilNet platform · 02 Protect

Protect one service, or the whole network.

Protect a single service, a whole machine or the entire network with ML-KEM-1024, ML-DSA-87 and AES-256-GCM, on any infrastructure and over any link, without changing your applications.

Book a demoChoosing a mode
In the guardian console

Commission every machine from one console.

Each machine is commissioned in the guardian and receives its manifest, then joins the network with its own post-quantum identity.

Illustrative

Nodes: every machine in every realm, its role, overlay address and days left on its credential, with newly commissioned machines arriving at the top.

What it fixes

Every finding has a fix.

How Protect addresses each finding from discovery.

  • Server refuses PQCProtect just that serviceProxy mode publishes the ports you name over the overlay, with no interface and no privilege. The server stays as it is.sudo conflux proxy 5432=127.0.0.1:5432
  • Client never offers itProtect the whole machineTUN mode protects every IP protocol, including TCP, UDP, QUIC and ICMP, with no change to the applications.sudo conflux up --ipv4 10.128.0.2/24
  • Can't run softwareProtect the network around itA subnet router carries PLCs, printers and cameras at their own addresses.sudo conflux up --subnet 192.168.20.0/24
  • Gateways between sitesDrop the VPN gatewayMachines authenticate each other directly across sites, clouds and NAT, with no gateway in the path.
Works everywhere

Per service, network-wide, anywhere.

  1. Per serviceProxy mode for containers, CI runners and hosts where you cannot get CAP_NET_ADMIN.
  2. Network-wideTUN mode for servers, VMs, gateways and laptops, and subnet routers for everything else.
  3. AnywhereLinux, Windows, macOS, FreeBSD and OpenBSD on amd64 or arm64, in any cloud or site, over fibre, 5G, satellite, radio or a serial cable.
Illustrative
$ sudo conflux proxy 8080=127.0.0.1:3000
Starting.
overlay fd80:c4b9:99ae:4411:6a1e:93c4:2d0b:7f15/48
serving 8080=127.0.0.1:3000
Layer by layer

The network is more than one layer.

Compare where each approach protects traffic, and how much of it.

OSI and TCP/IP models
OSITap a layerOurs
L7 · Application

Post-quantum libraries

OpenSSL 3.5✓ PQCOpen Quantum Safe✓ PQCPQShield✓ PQC

Each application upgrades its own cryptography.

Post-quantumYes, in each library that has been upgraded

Traffic it seals
TCP
Web and APIsDatabasesRemote access
UDP
Voice and videoDNSHTTP/3Logs and monitoring

Partly · only where each app has been upgraded

How far it reaches
Upgraded appAny IP network
AppRouterRouterApp
Other appsAny IP network
AppRouterRouterApp

Per application, once both ends are upgraded

Post-quantumClassical keysIn the clear
The catch

Every application, library and device has to be upgraded, one at a time.

L4–6 · Transport to presentation

TLS proxies

QuSecure✓ PQCF5 BIG-IP✓ PQCIstioPQC optional

A sidecar or gateway wraps each application's TCP connections in post-quantum TLS.

Post-quantumYes, but negotiated, with fallback to classical TLS

Often described as network-layer protection. In the OSI model, the network layer is Layer 3.

Traffic it seals
TCP
Web and APIsDatabasesRemote access
UDP
Voice and videoDNSHTTP/3Logs and monitoring

3 of 7 · TCP only

How far it reaches
App behind itAny IP network
AppProxyProxyApp
Other appsAny IP network
AppRouterRouterApp

Per application, proxy to proxy, for TCP only

Post-quantumClassical keysIn the clear
The catch

Each application has to be set up behind it, one at a time, and UDP, QUIC, DNS, voice and video pass it by.

L3 · Network

IPsec and mesh VPNs

Palo Alto NetworksPQC optionalFortinetPQC optionalstrongSwanPQC optionalTailscale✕ No PQCNetBirdPQC experimental

Gateways, or a mesh of machines, encrypt the IP traffic between them.

Post-quantumOptional on IPsec gateways, and missing or experimental on mesh VPNs

Traffic it seals
TCP
Web and APIsDatabasesRemote access
UDP
Voice and videoDNSHTTP/3Logs and monitoring

All of it

How far it reaches
IPsec gatewayAny IP network
HostGatewayGatewayHost
Mesh VPNAny IP network
HostRouterRouterHost

Site to site, or machine to machine. Classical keys by default

Post-quantumClassical keysIn the clear
The catch

Traffic is in the clear behind each gateway, and post-quantum is optional or still missing.

L2 · Data link

MACsec encryptors

Cisco✕ Not NIST PQCSenetasPQC on newer models

Hardware encrypts each Ethernet link, one hop at a time.

Post-quantumVaries: often pre-shared or QKD keys rather than NIST PQC

Traffic it seals
TCP
Web and APIsDatabasesRemote access
UDP
Voice and videoDNSHTTP/3Logs and monitoring

All of it

How far it reaches
Stops at the router
HostRouterRouterHost

Link by link, opened in every switch

Post-quantumClassical keysIn the clearOpened in a switch
The catch

Traffic is decrypted inside every switch, and only your own Ethernet links are covered.

L1 · Physical

Optical encryption and QKD

Ciena✓ PQCAdtran✓ PQCNokia✕ Not NIST PQCID Quantique✕ QKD, not PQCToshiba✕ QKD, not PQCQuantumCTek✕ QKD, not PQC

Special hardware protects one fibre span.

Post-quantumVaries by vendor, and QKD is a different technique, not PQC

Traffic it seals
TCP
Web and APIsDatabasesRemote access
UDP
Voice and videoDNSHTTP/3Logs and monitoring

Not applicable · Layer 1 carries light on a fibre, not protocols

How far it reaches
Your own fibre
HostOpticsOpticsHost

One span of your own fibre, between two sites

Post-quantumClassical keysIn the clear
The catch

It covers only fibre you own, between two boxes. QKD only shares keys, and the NSA and NCSC advise against it for government use.NSA ↗NCSC ↗

L2–3 · Data link and network

VeilNet

Any IP protocolMachines, VMs, containersEvery app, unchangedML-KEM-1024ML-DSA-87

Software seals every application's traffic end to end at Layers 2–3, with no changes to the apps.

Post-quantumRequired on every connection: ML-KEM-1024 and ML-DSA-87, with no fallback

Traffic it seals
TCP
Web and APIsDatabasesRemote access
UDP
Voice and videoDNSHTTP/3Logs and monitoring

All of it

How far it reaches
Any link
Host
VM
Container
App
Host
VM
Container
App

Every host, VM, container and app, end to end, over any link

Post-quantumClassical keysIn the clear
Good to know

Applications need no changes. A device that can't run VeilNet is reached through a subnet router, and that last link is classical.

Post-quantum status is taken from each vendor's public documentation, October 2026.

Talk to us

Ready to protect what discovery found?

Talk to us about protecting your first service. Once it is protected, Manage keeps it that way.

Talk to usNext: Manage