Cloud Fellows Web Gateway
One gateway across HTTP generations
Built for the next chapter of Security Service Edge: HTTP/1.1, HTTP/2 and HTTP/3 on both sides of a transaction, with independent protocol negotiation and one inspection and policy model across all of them. Encrypted, policy-controlled DNS steers each client onto the right path before the first connection.
Every protocol on either side. One policy layer in between.
Web Gateway terminates both connections, negotiates each protocol independently and applies one policy model throughout.
HTTP/3 becomes a fully governed SSE traffic path - not an encrypted fast lane around established inspection and control.
Protocol negotiation
HTTP/1.1, HTTP/2 and HTTP/3
Downstream and upstream connections negotiate independently through ALPN, DNS HTTPS records and Alt-Svc.
A client can connect over HTTP/2 while Web Gateway reaches an upstream server over HTTP/3 - or the combination can be reversed. Cleartext HTTP/1.1 and H2C are available where required.
Deep inspection across all protocols
HTTP/3 is no longer a blind spot
Apply the same security decisions to HTTP/3 traffic as to HTTP/1.1 and HTTP/2.
One transaction model exposes headers and streaming request and response bodies on every supported protocol. Policies can perform or integrate antivirus filtering, block detected content, modify traffic, generate responses, redirect requests and control routing - even when the client or upstream connection uses HTTP/3.
Deployment
One process, three roles
Use one role or combine them in a mixed deployment. Protocol selection remains independent on each connection.
Server
Serve local web content directly.
Reverse proxy
Protect applications and services.
Forward proxy
Govern outbound client traffic.
Secure DNS included
DoH, DoT and DoQ on both legs
One DNS service over UDP, TCP, DoT, DoH and DoQ, with the same records and the same policy on every transport.
Queries that Web Gateway forwards to the upstream resolver leave encrypted as well, over DoT, DoH or DoQ. The resolver's certificate is always verified, and nothing falls back to plaintext.
Read: The Secure DNS ProtocolsDNS security policy included
DNS policy: A better proxy.pac
A Python policy decides per hostname: straight to the origin, through the inspecting gateway, or blocked.
Gateway answers carry HTTPS records that describe the inspected path, with HTTP/3 for clients that can use it and HTTP/2 for those that cannot. Parallel A, AAAA and HTTPS queries share one decision, so the answers never contradict each other.
Read: The DNS Security PolicyHardened protocol stack
A systematic review of vulnerabilities published for other HTTP/2, HTTP/3, QUIC and DNS implementations led to dedicated defenses in 1.1.0: limits on control-frame floods and header-compression amplification, strict validation that stops request smuggling to HTTP/1.1 origins, and bounded QUIC and DNS state per connection and per client.
Certificate lifecycle included
Use the integrated ACME client with DNS-01 and TLS-ALPN-01 challenges, externally issued certificates or a self-signed certificate for first use. An encrypted secrets store protects keys and other secrets.
Flexible policy-engine architecture
The supplied Python engine demonstrates a language-neutral policy contract, including repeated streaming-body decisions. The architecture can accommodate partner-specific engines for OEM and specialized security products.
Observable and ready to automate
Plain-text health checks, a JSON status endpoint and a process status file support load balancers and supervisors. Structured logs can be extended with policy-defined fields and custom log files.
Purpose-built architecture
Modern C++ with an independent QUIC stack
A highly asynchronous, single-process foundation with minimal external dependencies. Its QUIC and HTTP/3 implementation is Cloud Fellows' own code - not a wrapper around a third-party QUIC library. Post-quantum ready: every TLS and QUIC connection, toward clients and toward origins, prefers the hybrid X25519MLKEM768 key exchange.
Suited to standalone deployments, embedded solutions and OEM integration. Supplied as a self-contained package for containerized Linux deployment.
Packet-level proof
HTTP/3 in. HTTP/3 out. Malware stopped in between.
See a decryptable Wireshark capture of Web Gateway allowing benign files, blocking the EICAR test signature and continuing on the same QUIC connection.
The article includes the packet-level analysis and a downloadable evidence package so that you can verify the result yourself.
Explore the HTTP/3 inspection evidence