NexGate
Enterprise Secure Gateway & Privileged Access Management
v2.1.1 — Cloud Native
9+
Protocols
28+
Security Features
12
Plugins
43
API Endpoints
763K+
Lines of Code
RDP VNC SSH Database Kubernetes Browser Isolation Zero Client Install Air-Gapped Ready
The Challenge

Why Organizations Need Secure Access

Privileged Access Abuse

80% of breaches involve compromised privileged credentials

Remote Workforce

Distributed teams need secure access to critical infrastructure from anywhere

Compliance Mandates

SOX, HIPAA, PCI-DSS, ISO 27001 require full audit trails & session recording

Tool Sprawl

Multiple tools for RDP, SSH, VPN, browser — fragmented security posture

Zero Visibility

No recording, no audit — impossible to know who did what on critical servers

VPN Weaknesses

Traditional VPNs grant broad network access — no granular session control

Insider Threats

Contractors, third-party vendors, and privileged admins with unchecked access

Breach Cost

Average data breach costs $4.45M (IBM 2023). Privileged access breaches cost even more

The Solution

One Platform. Complete Control.

NexGate unifies remote access, browser isolation, database sessions, Kubernetes management, and privileged access control into a single, browser-based platform — zero client install.

RDP VNC SSH Telnet PostgreSQL MySQL MSSQL Kubernetes Browser Isolation Web Apps
Zero Client Install Cloud Native Multi-Language (FA/EN)

RDP

Windows Remote Desktop

VNC

Linux / macOS

SSH

Secure Shell

Telnet

Legacy Systems

PostgreSQL

Interactive psql

MySQL

Interactive mysql

MSSQL

SQL Server

Kubernetes

kubectl sessions

Browser

Isolated Browsing

Architecture

Platform Architecture

Browser (React 18 + WebSocket)
SSH Client (Port 2222)
NexGate Core (Single Go Binary)
HTTP :8080 SSH GW :2222 NPE Engine 23 Services 12 Plugins 43 Handlers
PostgreSQL 16
Redis 7
ClamAV
CDR
Squid Proxy
RDP
VNC
SSH
Databases
K8s
Browser
CORE ADVANTAGE

Cloud Native Architecture

Traditional PAM (CyberArk, BeyondTrust)

Agent Install
Vault Server
Proxy Server
Target

Multiple servers, agent-based, vertical scaling only, complex HA setup, weeks to deploy

NexGate — Cloud Native

Browser
Single Go Binary
HTTP + Protocol Engine + SSH GW
Target

Stateless container, zero agents, horizontal auto-scaling, deploy in minutes

Containerized

Stateless single container. No agents, no JVM, no external daemons required

Auto-Scaling (HPA)

Kubernetes scales replicas automatically based on CPU/Memory thresholds

Low Footprint

~50MB RAM per pod. Go goroutines handle thousands of concurrent sessions

Crisis Ready

Spike from 1 to N pods in seconds. Rolling updates with zero downtime

Stateless 12-Factor Helm Charts Zero Downtime Deploy Health Probes
Connections

Multi-Protocol Connection Management

RDP

Windows Remote Desktop with NLA, drive mapping, clipboard, audio redirection

VNC

Virtual Network Computing with multi-display, encryption, and cursor tracking

SSH

Secure Shell with key auth, command filtering, session recording & audit

Telnet

Legacy system access with full session recording and audit trail

PostgreSQL

Interactive psql sessions through SSH Gateway with full recording

MySQL

Interactive mysql sessions with command auditing and access control

MSSQL

SQL Server access with session recording and privilege management

Kubernetes

Secure kubectl sessions with RBAC enforcement and audit logging

Browser Isolation

Ephemeral containers with web filtering, ClamAV & CDR scanning

Sessions

Session Management

  • Real-time session monitoring & live view
  • Full session recording with playback
  • OCR text extraction from recordings
  • Collaborative session sharing
  • Session watermarking for deterrence
  • Idle session auto-cleanup
  • Admin can kill sessions in real-time
  • Cloud recording storage (S3/MinIO/GCS/Azure)

Full Playback

Frame-by-frame session replay

OCR Search

Find text visible in recordings

Zstd Compression

Efficient storage format

Multi-Cloud

S3, MinIO, GCS, Azure Blob

KEY FEATURE

Secure Browser Isolation

Users browse the web inside ephemeral, isolated containers. No data touches the endpoint. Every session is secured, filtered, and scanned in real-time.

Ephemeral Containers

Destroyed after each session

ClamAV Scanning

Real-time malware detection

CDR Engine

Disarm file-borne threats

Squid Proxy

URL filtering & analytics

Zero Trust Browsing

All web traffic passes through
isolated containers + proxy + AV

Sandboxed Monitored
Browser Controls

Granular Browser Policies

Clipboard Control

Enable/disable copy-paste between host and browser

Download Control

Allow or block file downloads with CDR scanning

Upload Control

Restrict file uploads with antivirus scanning

Print Control

Enable/disable printing from browser

Browser Templates

Chrome profiles with preset bookmarks

Session Limits

Idle timeout & max duration policies

URL Analytics

Track visited URLs per user with JSON logs

Network Isolation

Separate browser-network (172.28.4.0/24)

Web Filtering

URL & Content Filtering

  • Domain blocklist / allowlist management
  • URL regex pattern matching
  • Content category filtering
  • MIME type blocking
  • File extension blocking
  • Real-time ACL sync to Squid proxy
  • JSON access logs for URL analytics
  • Allowlist or Blocklist mode

Squid Proxy Engine

Domain filtering, URL patterns,
content categories, real-time sync

Blocklist Allowlist Regex Categories
Authentication

Multi-Layer Authentication

MFA / TOTP

Google Authenticator, FreeOTP, any TOTP-compatible app

SSO

SAML 2.0 & OpenID Connect with Keycloak, Azure AD, Okta, Auth0

LDAP / Active Directory

Full group sync, mapping & certificate pinning for LDAP TLS

OAuth2 Server

Built-in authorization server for third-party integration

Guest Access

Temporary users with auto-expiry for contractors & partners

Certificate Pinning

OWASP TLS security — SHA-256 SPKI pin verification

Access Control

Granular Access Policies

Time-Based Access

Define access windows per user, group, or connection

IP Restrictions

Whitelist/blacklist specific IPs and ranges

Geo-Blocking

Country-level access control with GeoIP

JIT Access

Just-In-Time access with approval workflow

Break Glass

Emergency access with full audit trail

RBAC

Role-based access with fine-grained permissions

Group Policies

Inherit & override policies per group

Rate Limiting

Connection & bandwidth limits per user

Security

Antivirus & Content Disarm

ClamAV Engine

Real-time malware scanning for all file transfers and downloads

CDR Engine

Strip macros, scripts & embedded threats from office files

File Policies

Size limits, type restrictions, extension filtering per user/group

Quarantine

Infected files isolated for admin review and investigation

Defense in Depth

Every file transfer goes through:
ClamAV malware scan
CDR threat removal
Policy enforcement

Network

Network Security

Certificate Pinning

OWASP TLS pin verification (SHA-256 SPKI)

Rate Limiting

Connection & bandwidth limits per user/group

4 Isolated Networks

Frontend, Backend, Security, Browser

Container Hardening

Read-only FS, Seccomp, cap dropping

SSH Command Filter

Block dangerous commands with regex

File Transfer Policy

Size, type & direction restrictions

Session Watermark

User identity overlay for deterrence

Password Vault

Encrypted credential storage & injection

SSH Gateway

Transparent SSH Gateway

SSH Access

Direct SSH to servers via port 2222 with full audit trail

Database Access

PostgreSQL, MySQL & MSSQL interactive sessions with recording

Kubernetes

Secure kubectl sessions with RBAC enforcement

Session Recording

Zstd-compressed with full-text search & OCR

Command Filter

Regex pattern-based blocking & real-time alerts

Public Key + OTP

SSH key auth with MFA verification

TUI Menu

Interactive target selection with search & categories

JIT Access

Request & approve access on-the-fly

Live Monitoring

Real-time admin view of all gateway sessions

# Connect via SSH Gateway
$ ssh -p 2222 admin@nexgate.example.com
Monitoring

System Monitoring & Metrics

CPU & Memory

Real-time system resource monitoring with alerts

Disk & Storage

Storage usage, capacity tracking & threshold alerts

Service Health

Real-time status of PostgreSQL, Redis, ClamAV, CDR, Squid

URL Analytics

Track browsing patterns, top domains & user activity

Prometheus /metrics

Export all metrics to Prometheus
for Grafana dashboards & alerting

Active Users Session Trends Peak Hours Bandwidth
Audit

Comprehensive Audit Logging

  • Tamper-proof audit trail for all actions
  • Advanced filtering & full-text search
  • Export to PDF, Excel, CSV formats
  • Per-user action tracking & history
  • Timestamp, IP, and device logging
  • Real-time notifications on events

All Actions Logged

Login, connections, file transfers, settings changes

Powerful Search

Filter by user, action, date, IP, resource

Multi-Format Export

PDF, Excel, CSV for compliance

SIEM Forward

Send to Splunk, ELK, QRadar

SIEM

SIEM Integration

Forward security events to your SIEM platform in real-time for centralized security monitoring.

Splunk

HTTP Event Collector (HEC) integration for real-time event forwarding

ELK Stack

Elasticsearch, Logstash, Kibana pipeline with structured JSON

QRadar

IBM QRadar integration with LEEF/CEF formatted events

Custom

Webhook, Syslog, and REST API endpoints for any SIEM

Compliance

Compliance & Reports

Build any report template for any organization, in any format. Fully customizable compliance reports tailored to your industry standards and regulatory requirements.

  • Custom report templates for any organization
  • Export as PDF, Excel, CSV — any format you need
  • Scheduled automated report generation
  • Visual charts, graphs, and data tables
  • Organization branding & custom headers

SOX

Financial controls audit

HIPAA

Healthcare compliance

PCI-DSS

Payment card security

ISO 27001

Information security

Design any template — your logo, your format, your standards

Extensible

Plugin System

12 Built-in Plugins with hot-reload:

ACLAudit LogMFA Rate LimitRecordingReports PrometheusFile TransferFile Policy JIT AccessBroadcastsAction Tracking

10 Lifecycle Hooks:

pre_authpost_auth pre_connectpost_connect on_client_dataon_server_data pre_disconnectpost_disconnect on_erroron_tick

Modular Architecture

Enable/disable plugins via YAML config
Each plugin hooks into the interceptor chain
Zero downtime configuration changes

More

Additional Features

Web App Proxy

Secure access to internal web applications through reverse proxy

Support Tickets

Built-in help desk with priority levels & assignment

Infrastructure Mgmt

K8s & Docker deployment, scaling & monitoring

Storage Engine

Multi-backend: Local, S3, MinIO, GCS, Azure Blob

Multi-Language

Persian (RTL) & English with full i18n support

Notifications

Real-time WebSocket push + email notifications

Broadcasts

Scheduled system-wide announcements to users

Backup & Restore

Encrypted backups with scheduling & restore

User & Group Mgmt

RBAC with role inheritance & group policies

Dark / Light Theme

User preference with auto-detect

Global Search

Ctrl+K search across all entities

Onboarding Guide

Step-by-step interactive setup wizard

Deployment

Flexible Deployment

Kubernetes

Production-grade Helm charts for k3s, RKE2, EKS, AKS, GKE with horizontal auto-scaling and HA support

$ helm install nexgate ./chart
k3s RKE2 EKS AKS

Docker Compose

Complete stack with 6 services, 4 isolated networks, automated TLS, and volume management

$ docker-compose up -d
6 Services 4 Networks

Air-Gapped / Offline

Complete offline installer with 9 pre-built container images. Perfect for classified & restricted environments

$ sudo ./install.sh
9 Images 996 MB
Single Go Binary No External Dependencies Built-in NPE (Native Protocol Engine) Auto TLS (Let's Encrypt)
Tech Stack

Technical Specifications

Backend

Go 1.24Chi v5PostgreSQL 16Redis 7WebSocketJWTPrometheusK8s ClientDocker SDK

Frontend

React 18TypeScript 5.3Vite 5TailwindCSSZustandi18nextPlaywright

Scale

763K+
Lines of Code
165+
Go Files
69+
React Components
67+
Migrations
23
Services
36
Repositories

Infrastructure

ClamAV CDR Squid Proxy Kubernetes Docker
Security

28+ Security Features

Authentication

  • JWT with Refresh Tokens
  • MFA / TOTP
  • LDAP / Active Directory
  • SSO (SAML 2.0 / OIDC)
  • OAuth2 Server
  • Certificate Pinning
  • Guest Access (Temp)

Access Control

  • Time-Based Policies
  • Geo-Blocking (GeoIP)
  • JIT Access + Approval
  • Break Glass Emergency
  • Rate Limiting
  • RBAC + Group Policies
  • IP Whitelist/Blacklist

Threat Protection

  • ClamAV Malware Scan
  • CDR Threat Removal
  • SSH Command Filter
  • Web Filtering (Squid)
  • Browser Isolation
  • File Transfer Policies
  • Quarantine Engine

Monitoring & Audit

  • Session Recording + OCR
  • Session Watermarking
  • SIEM Integration
  • Real-time Notifications
  • Impossible Travel Detection

Infrastructure Hardening

  • Network Segmentation (4 Nets)
  • Read-Only Containers
  • Seccomp Profiles
  • Capability Dropping
  • Encrypted Backups
Market

The PAM Market Landscape

NexGate competes in the Privileged Access Management (PAM) and Secure Remote Access market alongside these major players:

Teleport

Cloud-native access platform with Zero Trust architecture. Strong K8s integration but expensive, no VNC support, limited offline deployment, complex setup for on-prem.

$$$$

CyberArk

Market leader in enterprise PAM. Very comprehensive but extremely expensive ($50-150/user/mo), complex deployment, requires dedicated infrastructure and professional services.

$$$$$

BeyondTrust

Enterprise PAM with remote support. Strong in endpoint privilege management but no browser isolation, no web filtering, limited offline deployment options.

$$$$

Teleport

Modern access platform for SSH, K8s, databases. Good developer UX but no RDP/VNC, no browser isolation, no CDR/AV, no web filtering. Expensive at scale.

$$$

HashiCorp Boundary

Zero-trust access for infrastructure. Focuses on identity-based access but no session recording, no GUI-based protocols (RDP/VNC), no browser isolation.

$$
Comparison

Feature Comparison

FeatureNexGateJumpServerCyberArkBeyondTrustTeleportBoundary
Browser-Based RDP/VNC
Native Protocol Engine
Browser Isolation
ClamAV + CDR
Session Recording OCR
SSH Gateway + Database
Plugin System
Web Filtering (Squid)
Air-Gapped Deploy
Multi-Language (RTL)
Geo-Blocking
Cloud Native / K8s HPA
Kubernetes Access
PricingCompetitiveFree (OSS)$$$$$$$$$$$$Free (OSS)

Why Choose NexGate?

All-in-One Platform

RDP, SSH, VNC, Telnet, Database, and Browser Isolation — all in one gateway. No more tool sprawl.

Enterprise Security

28+ security features with zero-trust architecture. ClamAV, CDR, certificate pinning, and more.

Unique Browser Isolation

No competitor offers integrated browser isolation with web filtering, CDR, and antivirus scanning.

Air-Gapped Ready

Complete offline installer for classified and restricted environments — ready in minutes.

10x Cost Savings

Enterprise-grade features at a fraction of CyberArk / BeyondTrust pricing. No per-user hidden fees.

Cloud Native Architecture

Stateless containers, K8s auto-scaling (HPA), zero downtime deploys. Scales from 1 to N pods in seconds.

NexGate

Secure Every Connection. Audit Every Action.

The only platform that combines remote desktop gateway, browser isolation, SSH gateway, database access, and privileged access management — in a single cloud-native binary.

9+ Protocols 28+ Security Features Cloud Native Air-Gapped Ready Browser Isolation
Schedule a Demo
v2.1.1 — Enterprise Secure Gateway & PAM