One Unified Partner to Protect & Scale Your Business.
Xoyan protects your infrastructure with perimeter firewall defense, isolated network segmentation, and secure remote access—integrated with Active Directory. Choose managed protection with ongoing updates and monitoring, or a self-managed deployment for full control.
Request pipeline
Every request is scanned before it reaches the core.
From architecture planning to ongoing operations, every stage is structured, documented, and verified. Each hit on the net is a request that never got in.
- Telemetry Ingestion & PlanSignals from your network, cloud, and endpoints stream in through structured address schemes.
- Perimeter Firewall & Segment IsolationpfSense default-deny rules and isolated VLANs suppress lateral movement.
- Verified Remote Access & OperationsEncrypted ZeroTier, OpenVPN, or WireGuard tunnels validated via 16-point testing.
Architecture & Planning
Define address schemes, server roles, and segmentation before deployment to establish a least-privilege network.
Engagement models
Three nets. One unified partner.
Start with the ring you need. Add the next one when you are ready, or switch seamlessly between fully managed protection and self-managed control.
Dedicated Network Defense & Maintenance
Xoyan configures, monitors, and maintains your firewall and remote-access infrastructure. We handle routine updates, configuration snapshots, and user access provisioning so your network stays secure without overburdening your staff.
Regular inspection of firewall logs, gateway metrics, and authentication patterns to catch anomalies early.
Scheduled maintenance windows and rollback-ready boot environments for safe updates.
Swift user onboarding, remote VPN certificate issuance, and immediate offboarding deauthorization.
Why Xoyan, Not DIY
Ad-hoc firewall rules, undocumented scripts, and unverified backups leave hidden exposure windows. Xoyan brings structured operational rigor, repeatable verification, and contractual accountability to your network defense.
Documented Runbooks & Acceptance Testing
Every firewall rule, VLAN policy, and VPN profile is accompanied by clear, step-by-step operational runbooks. Handover requires passing our rigorous 16-point acceptance test validating DHCP, DNS bypass blocking, domain auth, and segment isolation.
Rollback-Ready Updates & Config Snapshots
No policy change or firmware upgrade is pushed live without an automated, validated state snapshot. If an unexpected dependency surfaces, immediate rollback mechanisms restore the verified baseline in seconds without downtime.
Structured Incident Handling
When anomalous activity or perimeter threats are detected, containment protocols trigger immediately to isolate segments, preserve forensic audit logs, and coordinate active defense countermeasures.
Defined Support Hours
Direct access to security specialists with transparent availability windows, eliminating the ambiguity of best-effort community forums or overburdened in-house staff.
Committed Response Times
Committed service level agreements ensure priority intervention when it counts most, guaranteeing rapid escalation for critical security incidents and prioritized support for standard requests.
Bundled architecture
Inside the net, everything is connected.
One platform replaces a stack of separate tools. Data moves between them without leaving your protected perimeter. Essential perimeter firewall protection, isolated network segmentation, and secure remote access integrated under a single architecture.
- Perimeter Firewall
- Network Segmentation
- Multi-VPN (ZeroTier, OpenVPN, WireGuard)
- Active Directory Integration
- Threat Protection & Filtering
- ZFS Backups & Monitoring
- Guest Network Isolation
- Digital Marketing & SEO
Everything You Need to Defend & Expand
Perimeter Firewall
Stateful packet inspection with a default-deny policy. Every rule is deliberate, ensuring only permitted traffic enters or leaves each segment.
Network Segmentation
VLAN-based separation isolates domain controllers and servers from workstation networks, preventing lateral movement across segments.
Secure Remote Access (VPN)
Three flexible remote connectivity options—ZeroTier overlay, OpenVPN with Active Directory authentication, and WireGuard.
Active Directory Integration
Seamless domain join, Kerberos authentication, SMB file shares, and LDAPS-secured management logins through the firewall.
Threat Protection
Suricata intrusion detection and pfBlockerNG DNS filtering to intercept known malicious signatures and prevent DNS bypass.
Backups, Monitoring & Updates
Encrypted configuration backups, system health monitoring, and ZFS boot environments for safe, rollback-ready updates.
Guest Isolation
Dedicated guest network with strict internet-only egress, completely separated from internal servers and workstation subnets.
Digital Marketing & Brand Growth
Secure website architecture, technical SEO, and conversion optimization to help scale your brand and reach new customers safely.
Specialized Services
Purpose-built web engineering, infrastructure hardening, and organic digital growth execution delivered to protect and scale your operations.
Web Development
Fast, secure, conversion-ready sites with HTTPS enforcement, rigorous security headers, form protection, performance optimization, and technical SEO groundwork.
Security Hardening
Configuration review of servers, endpoints, and web applications, MFA, patching, access-control clean-up, plus a written remediation report.
Digital Marketing
Social media, content planning, SEO, paid, and reporting, offered separately from the security plans.
Core Security Principles
Our rule sets and network topologies are built around five fundamental principles.
Default Deny
All traffic is blocked by default; every pass rule is deliberate and documented.
First Match Wins
Rules evaluate top-to-bottom on interface entry; explicit blocks take precedence.
Stateful Inspection
Return traffic for permitted sessions is allowed automatically, focusing rules on initiation.
Least Privilege
Users, remote devices, and servers reach only the specific services and ports they require.
Isolated Enclaves
Servers, workstations, and guests reside on separate VLANs with zero uninspected cross-talk.
Remote Access Options
Compare the three remote-access VPN methods supported by Xoyan.
Access Control Matrix: Who Can Access What
Least-privilege network policies enforcing distinct access boundaries.
In Plain English: Understanding Business Cyber Risk
Cutting through the cybersecurity jargon for non-technical founders, directors, and managers. Here is what actually happens when security fails—and how four fundamental architecture choices protect your company.
What Happens When an Unprotected Business Is Compromised
Attacks rarely target complex encryption; they exploit open ports, flat internal networks, and unmonitored endpoints.
Costly Operational Downtime
Critical systems, databases, or workstations lock up or must be severed from the network. Employees are unable to work, orders cannot be processed, and revenue halts immediately while triage takes place.
Customer & Data Exposure
Sensitive client records, financial documents, employee files, or trade secrets are exfiltrated. Once data leaves your perimeter, confidentiality cannot be undone.
Erosion of Client & Partner Trust
Clients and business partners expect their information to remain confidential. A public security disclosure or compromised communication channel damages market reputation and can trigger client churn.
Exhausting Recovery & Remediation
Restoring a business after an intrusion involves forensic investigators, reimaging every endpoint, resetting credentials across the organization, and navigating potential regulatory inquiries.
How Xoyan Eliminates the Opportunity for Catastrophe
Defensive architecture that ensures an incident on one device cannot paralyze the rest of your business.
Default-Deny Policy
Closed by DefaultInstead of leaving doors unlocked and hoping attackers do not find them, every inbound and outbound path is shut. Only explicitly verified, required business traffic is allowed through.
Network Segmentation (VLANs)
Lateral Movement BlockedInternal networks are compartmentalized into distinct security zones. If an office laptop or guest device is compromised, strict boundary rules prevent the infection from spreading to file shares or domain servers.
Rollback-Ready Backups & Snapshots
Rapid RestoresAutomated, off-site, and isolated configuration baselines ensure your organization always has an uncorrupted point-in-time state to restore without having to rebuild from nothing.
Active Perimeter Monitoring
Early WarningPersistent inspection flags suspicious outbound traffic, repeated unauthorized probing, and policy exceptions before a minor anomaly escalates into a catastrophic operational failure.
Need clarity on your organization’s current exposure?
Our engineers walk through your architecture in clear terms with zero sales hyperbole.
Interactive Architecture Advisor
Solution Recommendation Calculator
Select your organization's scale and infrastructure to receive a tailored deployment recommendation. Tell us what you run today, and we will show you where the net has gaps.
Plan 1: Managed Protection
We recommend this plan for organizations that prefer ongoing firewall monitoring, maintenance, security updates, and access provisioning handled by Xoyan.
- Perimeter firewall deployment with default-deny policy
- Managed network segmentation and Active Directory integration
- Secure remote-access VPN (ZeroTier, OpenVPN, or WireGuard)
- Scheduled configuration backups and routine patch updates
Deployments typically require an x86-64 physical appliance or virtual machine with at least two network interfaces, 4 GB RAM (8 GB if running intrusion detection), and 16 GB SSD storage. A managed switch supporting 802.1Q VLAN trunking (or dedicated physical network interfaces per segment) is recommended. Remote access via OpenVPN or WireGuard typically requires a public IP address.
Open & Verified Foundations
Built on trusted, well-documented technology
Xoyan builds on widely used security software. Learn more about the technology behind your protection.
pfSense documentation
Perimeter firewall, default-deny policy, and VLAN routing
OpenVPN on pfSense
Client-server remote access with Active Directory authentication
WireGuard on pfSense
Fast, modern tunnel for administrators and IT staff
ZeroTier documentation
Peer-to-peer overlay network connecting remote devices
IDS/IPS on pfSense
Package-based intrusion detection and threat inspection
Suricata
High-performance network threat detection and rule sets
Active Directory over LDAPS (Microsoft)
Encrypted directory binds for firewall and VPN authentication
Blocking external DNS bypass
Preventing clients from bypassing internal DNS and blocklists
All product names and trademarks belong to their respective owners. Xoyan is not affiliated with or endorsed by them.
Schedule free security audit
Protect your assets. Accelerate your brand.
Speak directly with a Xoyan network specialist. Tell us about your network requirements or growth objectives, and we will prepare a tailored consultation.
Frequently Asked Questions
Everything You Need To Know
Have questions about our unified security model or digital marketing offerings? Here are answers to our most common inquiries.
What does Xoyan provide?
Xoyan provides perimeter firewall defense, network segmentation, and secure remote-access VPN solutions integrated with Active Directory. We offer both fully managed maintenance and self-managed deployments, alongside digital marketing services to help grow your business securely.
What is the difference between Managed and Self-Managed protection?
Under the Managed plan, Xoyan handles ongoing firewall monitoring, security updates, configuration backups, and user onboarding/offboarding. With the Self-Managed plan, we build and verify your configuration, then hand over full operational control and documented runbooks to your in-house IT team.
Which remote-access VPN option should we choose?
We typically support three proven options: ZeroTier is our recommended default because it connects outward and works seamlessly behind NAT and CGNAT without inbound port forwarding. OpenVPN is ideal if you require per-user Active Directory login verification over LDAPS. WireGuard is recommended for administrators needing a fast, minimal tunnel.
How does Xoyan verify that our network is secure?
Every deployment undergoes our comprehensive 16-point acceptance test before handover. This verifies DHCP, DNS resolution, Active Directory authentication, file share access, cross-VLAN segmentation, DNS bypass prevention, and guest network isolation.
What are the hardware and infrastructure requirements?
Deployments typically require an x86-64 physical appliance or virtual machine with at least two network interfaces, 4 GB RAM (8 GB if running intrusion detection), and a managed switch supporting 802.1Q VLANs. A public IP address is recommended if deploying OpenVPN or WireGuard.
How does Xoyan handle security incidents and what is your response SLA?
For managed defense clients, Xoyan provides active perimeter containment, anomalous egress blocking, and configuration rollback. Rapid response protocols prioritize critical alerts with incident handling covering perimeter firewall containment, forensic log preservation, and direct coordination with client IT.
Does Xoyan provide regulatory compliance certification (ISO 27001, SOC 2, HIPAA)?
Xoyan implements the technical and architectural safeguards—such as VLAN network segmentation, default-deny firewall policies, centralized audit logs, and MFA remote access—required by major compliance baselines. However, Xoyan is an engineering and implementation partner, NOT an accredited compliance auditing body, and we do not issue legal or regulatory compliance certificates. Formal certification requires an independent third-party audit.
What is included in Xoyan’s endpoint security coverage?
Xoyan concentrates primarily on perimeter firewall defense, secure network zoning, and encrypted remote access tunnels. Our security hardening service audits operating system baselines, access controls, and patch status on workstations and servers. Comprehensive endpoint detection and response (EDR) agent licensing and management can be coordinated with your existing endpoint provider.
Enterprise Cyber Defense & Scale. In Motion.
Continuous architecture demonstration — see how perimeter firewalls, segmented zero-trust tunnels, and rapid brand conversion operate together as a unified shield.