Skip to main content

Synapse

Synapse is a high-performance reverse proxy and firewall built with Rust, featuring:

  • XDP-based packet filtering for ultra-low latency protection at kernel level
  • Multi-backend firewall with automatic fallback (XDP > nftables > iptables > userland)
  • Dynamic access rules with automatic updates from Gen0Sec API
  • JA4+ fingerprinting complete suite: JA4, JA4H, JA4T, JA4L, JA4S, JA4X
  • TLS termination with your own certificates, or SNI passthrough to a backend that holds them
  • Threat intelligence integration with Gen0Sec API and Threat MMDB
  • Content scanning with ClamAV, aimed by a WAF rule at the traffic you choose
  • Upstream routing from a hot-reloaded file, with weighted backends and health checks
  • Weighted load balancing with hot-reloadable configuration
Platform support

XDP and eBPF need Linux with kernel 4.18 or newer. Without them Synapse still runs, falling back to nftables and then iptables. A Windows agent ships as well, capturing at L4 — see Installation.

Install it​

Synapse installs from the Gen0Sec package repositories, as a container, or into Kubernetes. The mode you want is chosen by which package you install.

The repositories are authenticated and signed, and there are two credentials involved, so the steps are worth following in order rather than pasting a command. Every channel — Debian, RHEL, binary tarball, Docker, Kubernetes and Windows — is on the Installation Guide.

Modes​

Synapse runs as an agent or a proxy, and the package you install decides which — synapse-agent or synapse-proxy. Both enforce in the kernel; the proxy adds everything that requires terminating the request.

Proxy only​

CapabilityAgentProxy
HTTP/HTTPS reverse proxy—Yes
TLS termination—Yes
Upstreams & load balancing—Yes
WAF (wirefilter)—Yes
Rate limiting—Yes
CAPTCHA—Yes
Content scanning—Yes
Request logging to the platform—Yes

Both modes​

Kernel enforcement is identical either way — the agent is not a cut-down build:

  • XDP packet filtering, with fallback to nftables, then iptables
  • Access rules, including dynamic updates from the platform
  • Firewall rules on address, port and protocol
  • Threat intelligence and GeoIP
  • Inline IDS, with kernel-level blocking on a verdict
  • BPF statistics and TCP fingerprinting
  • File and syslog logging, and multiple network interfaces

Where they differ in degree​

JA4+ fingerprinting is the one capability that is not simply on or off. The proxy captures the full suite natively from the TLS terminator. A Linux agent captures the same family through libssl uprobes and a TC-egress collector, so coverage depends on the host's libssl being uprobe-attachable. A Windows agent is L4-only.

Threat intelligence applies at the request level in proxy mode, and at the network level in agent mode.

Features​

Multi-backend Firewall​

  • Automatic fallback - XDP/BPF > nftables > iptables > userland
  • Dynamic access rules - Allow/block lists auto-updated from Gen0Sec API
  • BPF map enforcement - Rules enforced at kernel level via XDP
  • IPv4/IPv6 dual-stack - Separate rule sets, zero-downtime updates
  • BPF statistics - Packet counters, dropped IP tracking (XDP only)

Threat Intelligence​

  • IP reputation scoring - Automatic scoring via Gen0Sec API
  • Threat MMDB - Local MaxMind database for offline lookups (auto-updated)
  • GeoIP MMDB - Country, ASN, and city-level geolocation (auto-updated)
  • Bot detection - Advanced detection and mitigation
  • Redis caching - Cached threat data for performance

JA4+ Fingerprinting​

  • JA4 - TLS client fingerprinting from ClientHello
  • JA4H - HTTP header fingerprinting
  • JA4T - TCP fingerprinting from SYN packet options
  • JA4L - Latency fingerprinting from packet timing
  • JA4S - TLS server fingerprinting from ServerHello
  • JA4X - X.509 certificate fingerprinting

WAF (Wirefilter Expressions)​

  • Expression engine - Filter by request method, path, headers, and more
  • Actions - Allow, block, challenge or rate limit, based on expression matches
  • Centralized management - Expressions fetched from Gen0Sec API

TLS Management​

  • Your own certificates - Provide the certificate and key; Synapse terminates with them
  • SNI passthrough - Forward the connection encrypted when the backend must hold the key
  • HTTPS enforcement - Force HTTPS with HTTP upgrade responses
  • On Kubernetes - cert-manager issues and renews, as documented in Kubernetes Ingress

Architecture​

Components​

  • Multi-Backend Firewall - XDP/nftables/iptables/userland packet filtering
  • HTTP/TLS Servers - HTTP traffic handling and HTTPS connection management
  • Internal Services Server - Unified server for CAPTCHA and certificate management
  • Reverse Proxy - Request forwarding to upstream services
  • Upstreams Manager - Routing with service discovery, weighted load balancing, and hot-reloading
  • Threat Intelligence - Gen0Sec API and Threat MMDB integration
  • GeoIP Manager - Country, ASN, and city-level geolocation via MMDB
  • Access Rules Engine - Dynamic IP allow/block lists with periodic API updates
  • BPF Statistics Collector - Kernel-level packet processing tracking
  • TCP Fingerprint Collector - SYN fingerprint extraction and analysis
  • Fingerprint Engine - Complete JA4+ suite: JA4, JA4S, JA4T, JA4TS, JA4H, JA4L, JA4SSH, JA4X, JA4D, JA4D6
  • CAPTCHA Engine - Multi-provider CAPTCHA validation
  • File/Syslog Loggers - Rotating file-based and centralized syslog logging
  • Event Queue - Unified batch processing for logs, statistics, and events
  • Redis Cache - Certificates, threat intel, CAPTCHA, and content scan results

Performance​

  • Ultra-low latency - XDP filtering operates in kernel space
  • High throughput - Rust-based implementation with async I/O
  • Memory efficient - Minimal footprint with efficient caching
  • Scalable - Multiple network interfaces and concurrent connections

Documentation​

Need Help?​