Cloud Fellows Web Gateway
One gateway across HTTP generations
Built for the next chapter of Security Service Edge: HTTP/1.1, HTTP/2 and HTTP/3 on both sides of a transaction, with independent protocol negotiation and one inspection and policy model across all of them.
Every protocol on either side. One policy layer in between.
Web Gateway terminates both connections, negotiates each protocol independently and applies one policy model throughout.
HTTP/3 becomes a fully governed SSE traffic path - not an encrypted fast lane around established inspection and control.
Protocol negotiation
HTTP/1.1, HTTP/2 and HTTP/3
Downstream and upstream connections negotiate independently through ALPN, DNS HTTPS records and Alt-Svc.
A client can connect over HTTP/2 while Web Gateway reaches an upstream server over HTTP/3 - or the combination can be reversed. Cleartext HTTP/1.1 and H2C are available where required.
Deep inspection across all protocols
HTTP/3 is no longer a blind spot
Apply the same security decisions to HTTP/3 traffic as to HTTP/1.1 and HTTP/2.
One transaction model exposes headers and streaming request and response bodies on every supported protocol. Policies can perform or integrate antivirus filtering, block detected content, modify traffic, generate responses, redirect requests and control routing - even when the client or upstream connection uses HTTP/3.
Deployment
One process, three roles
Use one role or combine them in a mixed deployment. Protocol selection remains independent on each connection.
Server
Serve local web content directly.
Reverse proxy
Protect applications and services.
Forward proxy
Govern outbound client traffic.
Integrated DNS and protocol advertisement
The built-in DNS service combines local records with recursive proxying, can override answers and synthesize HTTPS/SVCB records. Web Gateway controls client-facing Alt-Svc advertisements independently of upstream discovery.
Certificate lifecycle included
Use the integrated ACME client with DNS-01 and TLS-ALPN-01 challenges, externally issued certificates or a self-signed certificate for first use. An encrypted secrets store protects keys and other secrets.
Flexible policy-engine architecture
The supplied Python engine demonstrates a language-neutral policy contract, including repeated streaming-body decisions. The architecture can accommodate partner-specific engines for OEM and specialized security products.
Observable and ready to automate
Plain-text health checks, a JSON status endpoint and a process status file support load balancers and supervisors. Structured logs can be extended with policy-defined fields and custom log files.
Purpose-built architecture
Modern C++ with an independent QUIC stack
A highly asynchronous, single-process foundation with minimal external dependencies. Its QUIC and HTTP/3 implementation is Cloud Fellows' own code - not a wrapper around a third-party QUIC library.
Suited to standalone deployments, embedded solutions and OEM integration. Supplied as a self-contained package for containerized Linux deployment.
Packet-level proof
HTTP/3 in. HTTP/3 out. Malware stopped in between.
See a decryptable Wireshark capture of Web Gateway allowing benign files, blocking the EICAR test signature and continuing on the same QUIC connection.
The article includes the packet-level analysis and a downloadable evidence package so that you can verify the result yourself.
Explore the HTTP/3 inspection evidence