Publish without risk
NSGW is the ingress boundary; NSN is the exit boundary. Unauthorized traffic never enters the site — it is dropped at the gateway, before it reaches your internal network.
Solutions · Private App Access
Publish private services without exposing the whole network.
Publish the service path you need, not the whole network around it. NetSeed gives internal applications a controlled ingress path — browser, API, or client access without opening a broad tunnel.
Expose the service. Keep the network private.
With a traditional VPN or bastion, granting access to an internal service means granting access to the network segment it sits in. NetSeed separates those two things — publish the service path, and NSN enforces the boundary at the workload.
-
Browser, API, and client access Internal services are reachable from browsers, API clients, and NSC — without the user needing to configure network routing.
-
NSGW controlled ingress All access enters through NSGW, which evaluates identity and policy before traffic reaches the site. The internal network is never directly exposed.
-
NSN site-side decision NSN applies access control next to the workload — the final and authoritative enforcement point, even if the control plane is unreachable.
-
Fits internal platforms and back-office Internal tooling, back-office systems, admin APIs, and restricted services can be published to the right audience without network reconfiguration.
-
Restricted API access Publish specific API endpoints for partners or internal consumers. The scope is the API — not the server, the subnet, or the rack.
How it works
Controlled ingress, site-side decision.
Access to an internal service follows a path with two enforcement points. Neither point alone can be compromised to bypass the other.
Publish the service
Register the internal service with NetSeed — give it a name, define who can access it, and assign it to an NSN. No firewall rule, no DNS delegation.
Identity at the gateway
When a user or client connects, NSGW verifies identity and evaluates policy before forwarding any traffic. Unauthorized requests are dropped at the perimeter.
NSN proxies and enforces
NSN receives the authorized flow and proxies it to the local workload. ACL is applied at egress — so the site has the final say even if the gateway is misconfigured.
Flow record emitted
Every authorized access to the published service produces a per-flow audit record: identity, device, service, bytes. The record lives in your SIEM or audit store.
Use cases
What you can publish with NetSeed.
Internal developer portals
Publish internal tooling — CI dashboards, deployment portals, internal docs — so engineers can reach them without a broad VPN grant.
Back-office and admin systems
ERP, CRM, HR, and finance systems can be published to named users or groups — no shared admin subnet, no VPN all-access pass.
Partner and consumer APIs
Publish specific API endpoints to external partners or internal consumers with identity-scoped access and a full audit trail.