Security Platform
Cosinium OS
The firewall operating system that keeps your network yours, at home, in the office, in the cloud and wherever you take it.
On a real 2.5 Gbps PPPoE line, Cosinium pushes 2.23 Gbit/s, which is 94–97% of everything the wire can physically deliver. The stock Linux path is stuck at 1.55 Gbit/s (66%).
NanoPi R6S, live line, iperf3 TCP, median of three 20-second runs. July 2026.
Cosinium OS is the foundation that all our products align to. It is a lean image-based operating system, meaning it is self-contained and there is no installer; write the image, power on, answer a few brief questions, and it's ready! There are no packages to install because that often leads to compatibility issues or a broken system. Every program we ship with Cosinium must have a good reason to exist, and if it does, it carries a complete lifecycle: configuration, testing and use.
Cosinium - the one operating system for the box at the edge of your network, whether that box is a pocket appliance, a rack server, a cloud instance or a container on a host you already run. They all run with the same configuration model, provide the same API and can be upgraded in the same way.
What does Cosinium need?
Cosinium is a lightweight image that can be written to bootable storage of 8GB minimum, although we recommend 16GB or more for flash media when logs and telemetry are enabled. Runtime requires a minimum of 2 CPU cores and 1GiB memory. When using address or block lists, we recommend 4 CPU cores and 2GiB memory. Size your system according to your needs.
Firewall
Linux based firewall with atomic configuration reload.
- Rules expressed as zones
- Firewall rules are configured as zones, such as wan, lan, vpn and dmz, to ensure that everything continues to work when replacing a network adapter, moving to different hardware or importing configuration.
- Load balancing, NAT, port forwarding
- Whether you want to distribute inbound connections across a backend pool of services, mask your network hosts, or port forward inbound connections - they are all part of the same atomic ruleset as everything else.
- Multiple address list types
- Address lists sourced from a feed: threat intelligence, geography, or your own.
- One-click blocking from persistent intruders
- Block an attacking source, including their network, straight from the traffic view.
- Tuning for improved throughput
- Cosinium tunes and enables kernel features that improve network throughput specific to the hardware platform. For example, Linux nft flowtable is enabled by default to support fast delivery of packets, and receive packet steering is applied to network interfaces that require it.
- Transparent TLS inspection
- Capture, review, and block TLS (including QUIC) traffic passing through Cosinium. Note: this requires a root certificate to be installed on the host to be inspected.
DNS
Highly capable Technitium DNS resolver with a large set of telemetry.
- Block list filtering
- Subscribe to hosts-format or domain-list feeds which are refreshed on your schedule. Protect your network from malware, ads, and adult content sites with one-click enablement in Cosinium Express mode.
- DHCP live feeds
- Look up systems by their names, rather than their addresses, with LAN system address assignments and presence fed from the DHCP server.
- Policy routing by domain name or organisation ASN
- Send a domain or organisation-owned IP address set (part of their Autonomous System Numbers) out of a chosen outbound path that you've configured: an internet provider uplink, a QuicN network, an OpenVPN or IPsec tunnel, or a specific gateway. Using an organisation's ASN dataset means no DNS capture is required, so no added delay, and it catches traffic that never talks to DNS. If that outbound path is down, the client will fail its connection rather than having its data leak elsewhere,
- Dynamic DNS for any provider
- IPv4 and IPv6 DDNS updates using HTTP; Cloudflare, No-IP, Route 53 and anything else are the same mechanism.
Connectivity
- PPPoE eXpress Path
- Cosinium's own high performance PPPoE implementation, delivering 2.5x more upload/3x more download than the Linux kernel path gets on the same box. Firewall security is still enforced to protect your network.
- End to end IPv6
- IPv6 internet access ready with automated configuration and live changes detected on every Internet access availability. We developed a DHCP client (dhcpc-rs) specifically to facilitate the wide variety of IPv6 features and options that come from service providers.
- Live tracking of network interfaces
- Anything that changes on a network interface is immediately detected: link, carrier, address, PPP and express-path changes are visible to you.
- Choice of VPN stacks
- QuicN, OpenVPN, IPsec/IKEv2 and WireGuard with profile import and certificate issuing. All four integrate into the firewall VPN rules.
Operations
- Signed images that are verified at download and activation
- Cosinium upgrade images are securely signed to prevent image tampering. Additionally, image extraction at next-boot activation checks the existence of every file in them.
- 2 OS layers and A/B boot slots with automatic rollback
- Cosinium OS consists of an outer host filesystem that handles the hardware boot stage and an inner image that runs the business logic. A new runtime image only becomes active when it boots and is running stably, with recovery available on a failed boot.
- Back in service in less than 30 seconds
- Restarting without a complete kernel reboot enables fast bringup to reduce any downtime. A full power reboot is under 30 seconds from BIOS/firmware POST.
- Every change is reversible
- Each subsystem keeps a patch log beside its configuration and enables rolling back N-steps to reverse every change across all of them at once. Configuration rollback can be applied even when running a newly updated image.
- Snapshots, backup and cross-system import
- Take a full-system snapshot whenever you want one. Schedule fully encrypted backups and upload them to your own server. Restore the whole configuration from it, or import selected parts.
- An API, a web UI and a real shell
- JSON-based RPC API over HTTP, as used by the web UI and shell is also
what you can use to implement your own automation. Two request forms
with role-based entitlements:
GETto read,POSTto add/change/delete. Cosinium's CLI provides an interactive shell or one-shot command line requests.