DiscrimiNAT Firewall Reviews 2025: Details, Pricing, & Features

Paul S.

Cloud Security Engineer

Enterprise(> 1000 emp.)

Validated Reviewer

Verified Current User

Review source: Organic

Nov 18, 2021

"Secure egress solution with very straightforward rule configuration"

What do you like best about DiscrimiNAT Firewall?

We really like the speed and simplicity of deployment using Terraform with the vendor-supplied modules, no need for console access, and authorization determined by security group rule descriptions. We initially used the "see-thru" mode to determine existing outbound traffic without enforcement.

We simply replaced our existing NAT Gateways with DiscrimiNAT, added the rules to our security groups, then checked traffic details in CloudWatch logs (AWS) or Cloud Logging (GCP).

It's particularly well suited to our organization with a large number of autonomous teams who want a simple, secure egress solution that's easy to configure, no change to application code, and no need for explicit proxy settings.

DiscrimiNAT is available via AWS and GCP Marketplaces, so it's easy to procure - as the cost is simply included in the monthly cloud provider bill.

There's a high standard of documentation with example Terraform code, and we received a prompt response to a minor technical query. Review collected by and hosted on G2.com.

What do you dislike about DiscrimiNAT Firewall?

One downside of DiscrimiNAT is that it can't filter on URL path - for example, you can't block all of github.com except for github.com/mycompany. However, implementing that level of control would require an SSL interception solution which isn't suitable for us, due to the need to install the proxy certificate chain as trusted in our server operating systems and applications. Review collected by and hosted on G2.com.

What problems is DiscrimiNAT Firewall solving and how is that benefiting you?

DiscrimiNAT provides controlled egress to authorized domains from cloud computing environments in AWS and GCP, using TLS and SSH. It significantly reduces the risk of data exfiltration, malware, and command and control using reverse shell attacks. Review collected by and hosted on G2.com.

Show Less

Helpful?

Admin Approval Link

DiscrimiNAT Firewall Overview

edit

What is DiscrimiNAT Firewall?

The DiscrimiNAT Firewall is a transparent, proxy-less Managed NAT alternative to discover & filter egress traffic by FQDNs in a Shared VPC. It's built upon our cutting-edge technology, Wormhole DNS, that handles highly variable, low TTL and load-balanced domain name resolution results perfectly well to give your applications uninterrupted access to allowed destinations. CONSOLE INTEGRATION There are no new UIs to learn – the configuration is stored in cloud resources directly, and the flow & audit logs go to the native logging service. GitOps FTW because only cloud's APIs are used for interfacing, you will never have to leave the cloud console. SPOOFING PREVENTION Unlike SNI only or Suricata based, DiscrimiNAT does conduct out-of-band DNS lookups, so TLS SNI spoofing by supply-chain malware will be logged & stopped. It even supports allowing SSH by FQDNs. The next Log4J won't slip through! SAFE WILDCARDS Public Suffix List safeguard in place, by default, to reject wildcard patterns matching all tenants on a CSP or a CDN (aka Effective TLDs); precise patterns can also be configured with use of glob characters (*, ?). TRANSPARENT OPERATION No need to set http_proxy like environment variables or change any code. Everything in the VPC, from VMs to k8s and Serverless, will have its egress traffic routed through DiscrimiNAT. Swapping to (and from) Managed NAT is just changing a route table entry. FQDN DISCOVERY Don't know what needs allowing? With the ‘see-thru’ monitor mode, egress traffic can be logged without blocking; then a CLI command extracts FQDNs accessed. We have a 3½ min video on how easy it is! LEAST PRIVILEGE EGRESS You no longer need to apply the entire allowlist to large CIDR ranges hosting multiple applications. The policies are as granular as native firewall rules/security groups, so each application gets access to only what it needs. This translates to micro-segmentation in Zero Trust architectures. DEVELOPER GUARD RAILS With bidirectional enforcement of TLS 1.2+ and SSH v2, automated expiry of exemptions, dropping unencrypted Internet-bound traffic, etc., each feature has been carefully designed to avoid footguns. REFINED OPERABILITY DiscrimiNAT integrates with cloud's native load balancers and runs with high-availability, load-balancing & auto-scaling within your VPC. It's also completely maintenance-free! ENTERPRISE READY Whether you seek compliance with PCI DSS v4.0 or NIST SP 800-53 AC-4 , SC-7 and SC-8, we've got it covered. Also, DiscrimiNAT is hardened to CIS Ubuntu Linux 20.04 LTS Benchmark v1.1.0 Level 2 - Server. Besides the quarterly updates, critical OS updates are released in less than 10 days and rolling updates apply seamlessly.

DiscrimiNAT Firewall Details

Discussions

DiscrimiNAT Firewall Community

Show LessShow More

Seller Details

Seller

Chaser Systems

Year Founded

2019

HQ Location

Cambridge, England

Twitter

@ChaserSystems
68 Twitter followers

LinkedIn® Page

www.linkedin.com

Description

The trinity of 'developer experience + security standards + operational excellence' is greater than the sum of its parts. We call it 'ergonomic cybersecurity'.

Overview Provided by:

Dhruv AHUJA

Recent DiscrimiNAT Firewall Reviews

2/20/2025

Verified UserEnterprise (> 1000 emp.)

4.5 out of 5

"Good forward proxy for our egress security on Google Cloud"

We like the fact that DiscrimiNAT is doing FQDN filtering on SNI while being a transparent proxy, that it integrates with native firewall rules on ...

11/18/2021

Paul S.Enterprise (> 1000 emp.)

5.0 out of 5

"Secure egress solution with very straightforward rule configuration"

We really like the speed and simplicity of deployment using Terraform with the vendor-supplied modules, no need for console access, and authorizati...

This seller hasn't added their security information yet. Let them know that you'd like them to add it.

0 people requested security information

DiscrimiNAT Firewall Media

DiscrimiNAT Firewall Demo - [AWS] FQDNs in native egress Security Groups

Just add the FQDNs in the description field of the usual AWS Security Groups, associated per application/VMs.

DiscrimiNAT Firewall Demo - [GCP] FQDNs in native egress Firewall Rules

Just add the FQDNs in the description field of the usual GCP Firewall Rules, associated per application/VMs by the way of Network Tags.

DiscrimiNAT Firewall Demo - [GCP] Logs in StackDriver

Config Audit and Flow logs appear in StackDriver with zero config required.

Just add the FQDNs in the description field of the usual AWS Security Groups, associated per application/VMs.

DiscrimiNAT Firewall Demo - [AWS] Logs in CloudWatch

Config Audit and Flow logs appear in CloudWatch with zero config required.

G2 reviews are authentic and verified.

Here's how.

Verified User in Manufacturing

Feb 20, 2025

We like the fact that DiscrimiNAT is doing FQDN filtering on SNI while being a transparent proxy, that it integrates with native firewall rules on GCP and that it's really fast and performant. We deploy it with the Terraform module and it's maintenance-free for us. In addition, we always had really fast feedback and help from the Team anytime we reached out for advice / feedback. Price is also good. Review collected by and hosted on G2.com.

We don't have any issues as of now. In the past, the lack of wildcards was a downside, but it's now fully supported. Review collected by and hosted on G2.com.

We have a security requirement to filter egress traffic from our Cloud infrastructure. DiscrimiNAT makes that easy and integrates well. Review collected by and hosted on G2.com.