Solutions · VPN infrastructure

Protection for the tunnel endpoints you already run

UMBREN places a protected address in front of your VPN servers and filters attacks before they reach them. It is not a VPN service. You keep your servers, your subscribers and your keys.

Get Protected Talk to us

What UMBREN is and is not

UMBREN is not a VPN provider

UMBREN does not sell VPN connections and has no VPN subscribers of its own. It protects the tunnel endpoint address that a VPN operator already runs. Everything inside the tunnel, and everyone who uses it, stays with the operator.

What UMBREN does

Places a protected address in front of a tunnel endpoint you have registered and verified.
Filters attack traffic on an upstream scrubbing network, according to your mitigation policy.
Forwards legitimate traffic to your origin server.
Reports traffic, mitigation activity and incidents to your team.

What UMBREN never does

Sell, resell or operate VPN connections.
Handle your subscribers. No accounts, no sign-ups, no billing, no support.
Hold, generate or receive your keys.
Read what travels inside your tunnels. UMBREN has no keys, so tunnel contents stay opaque to it.

WireGuard-compatible UDP profile

A protection profile for tunnel traffic over UDP

Choose the WireGuard-compatible profile when you register the endpoint. Protocol Guard then applies its wireguard profile to the endpoint, alongside the packet, flood and flow settings in your policy.

The profile needs no key material. Ownership is proven by where your server is on the network, not by anything inside the tunnel.

WireGuard is a registered trademark of Jason A. Donenfeld. UMBREN is not affiliated with or endorsed by the WireGuard project. “WireGuard-compatible” describes the kind of traffic the profile is written for.

Handshake rate limits. max_handshakes_per_source_per_minute limits how often one source may start a handshake. The default is 60.
Handshake enforcement is opt-in. enforce_handshake is off by default. Run the policy in monitor mode with it switched on and read the result before you enforce it.
Established tunnels are protected. Flow Guard protects established flows by default while it limits how quickly a source may open new ones. Subscribers who are already connected are treated differently from traffic that has only just appeared.
Idle flows age out. A flow that has been idle for idle_timeout_seconds, 180 by default, is no longer treated as established.
Reflection sources are dropped. Packet Guard drops traffic from the source ports in its blocked list. The defaults are ports commonly abused for reflection.

Example

How a VPN operator brings a server under protection

An operator runs a WireGuard-compatible server on one public address and one UDP port. Their subscribers connect to that address today. This is what changes, and what does not.

On the origin server

umbren-agent verify --token <challenge>

The agent makes one outbound HTTPS request carrying the challenge. It sends nothing else, opens no port, installs nothing and exits. UMBREN never connects to, scans or probes the server.

Ownership verification in the documentation

Register the server address and UDP port
The operator registers the endpoint under the VPN Infrastructure category: the server's public address, UDP, the port the tunnel listens on, and the WireGuard-compatible profile.
Verify ownership
The dashboard issues a one-time challenge. The operator runs the verification agent on the server. UMBREN compares the address the request arrives from with the registered address. Typing an address into a form is never accepted as proof.
Validation and staging
The endpoint is checked for compatibility. A protected address is then reserved upstream and configured to forward to the server. No traffic moves yet.
Prepare the origin and test
The operator confirms that the server's firewall accepts clean traffic from the delivery ranges shown on the endpoint page. The staged path to the server is then tested.
Authorize activation
When every activation gate holds, a member of the operator's team with activation rights types the endpoint name to approve the change. API credentials cannot do this.
Point clients at the protected endpoint
The operator publishes the protected address as the tunnel endpoint. Subscriber accounts, keys and the VPN service itself stay exactly where they were: with the operator.

Control

Your service stays yours

UMBREN defends an address. It does not sit between you and your subscribers' accounts, and it does not change how your VPN works.

Your subscribers

UMBREN has no relationship with the people who use your VPN. It never sees a sign-up, a login or a payment.

Your keys

Keys are generated, stored and rotated on your infrastructure. UMBREN does not ask for them and does not need them.

Your servers

The origin remains your server on your address. Nothing changes how traffic reaches it until your team authorizes activation.

Your visibility

Bandwidth, packet rate, protocol distribution and allowed versus mitigated traffic are reported per endpoint, with no placeholder data.

Incident and endpoint events can be sent to email, Discord or a signed webhook. Origin addresses are never included in webhook payloads.

Keep your tunnel endpoints reachable

Create an account, register a tunnel endpoint and verify that the server is yours. Protection is activated only after every check has passed and your team has authorized the change.