NovaStack EdgeShield How a network disappears

What actually changes

The same door, for your staff and for an attacker

Today everyone arrives at the same place: your name is looked up, your address is found, your ports are knocked on. EdgeShield removes that door — it does not guard it harder.

TODAY Your staff anywhere Anyone else scanners, bots PUBLIC DNS admin.acme.com.my 203.0.113.10 Your server open to the internet 443 admin 22 ssh 3389 rdp 3306 db every one of these answers to whoever knocks connects in looks up looks up one door, and both arrive at it WITH EDGESHIELD Your staff Ikat agent 100.64.0.2 EdgeShield introduces the two carries only sealed traffic in Malaysia Your server Ikat agent 100.64.0.7 connects out connects out sealed end to end — EdgeShield cannot read it Anyone else scanners, bots WHAT THEY FIND admin.acme.com.my — no such name 203.0.113.10 — no ports answer nothing to log in to, nothing to exploit no way further STILL PUBLIC ON PURPOSE www.acme.com.my your shopfront still answers the world Customers and the public
What changes is direction. Today connections come inward from the internet, and your staff use the same door as an attacker. Afterwards there is no inbound door at all: your server and your staff's device both connect outward and meet inside a sealed tunnel. Your public website stays public — what disappears is the admin panel, SSH, the database and the internal apps.

What goes on your server

Nothing stands in front of your server

This is the first thing almost everyone asks, and the answer usually surprises them: EdgeShield is not a box that stands at your door. If something stands at the door, the door still exists — people can still reach it and knock.

What you install does not listen for anyone

It is a small program inside your server. It opens no port and waits for no incoming connection. It dials outward to EdgeShield and stays connected. That is why there is nothing to knock on — not because knocks are refused, but because there is no door there.

—

Two files, one command

Download, unpack, and run the installer with your organisation's address and a one-time key from your console.

sudo ./install-linux.sh \
  --server https://your-org.edgeshield.novastack.com.my \
  --key    hskey-auth-your-key

Your server then has an internal address like 100.64.0.7, and your staff reach it there.

—

Nothing else changes

No appliance, no proxy in front, no change to your application, no database rewrite. Your server stays the same server — it simply stops answering the outside world.

When you have many systems

Hide one system, leave the rest open

This is not an all-or-nothing proposition. Most organisations want their shop and their website to stay open, and only want the accounts system — or the admin panel, or the database — to disappear from view.

The internet customers, bots Your staff Ikat agent ONE SERVER, ONE PUBLIC ADDRESS www.acme.com.my listen 443 public shop.acme.com.my listen 443 public crm.acme.com.my listen 443 public account.acme.com.my listen 100.64.0.7:443 private same server, same port number — a different ear cannot reach it reaches it normally
Port 443 stays open, because the other three systems need it. What changes is which ear the accounts system listens on: no longer every interface, only the mesh address. That address does not exist for anyone without Ikat.
—

If it has its own server

Simpler still: put Ikat on that server alone, remove its public DNS record, close its ports. The other servers are not touched at all.

—

Your staff type the same name

Point account.acme.com.my at the mesh address, so nobody has to learn a new address or change a bookmark. They will not notice anything changed; outsiders will not find anything.

The trap that bites after a reboot

When the server restarts, the web server can come up before Ikat has raised the mesh address. It tries to bind an address that is not there yet, fails, and the whole server stays down — including the public sites that had nothing to do with it. This is avoided by making the web server depend on the Ikat service, or by allowing binds to an address that does not exist yet. We set this during installation; it is written here because teams doing it themselves routinely miss it.

Getting there

Four steps, and the ports close last

The order matters. Nothing is closed until everyone is proven to be getting in the new way.

1

Put Ikat on the server

The server joins your private network and gets an internal address. Nothing changes from outside yet — the old ports are still open.

2

Put Ikat on the staff devices

Everyone reaches the server on that internal address instead of the public name.

3

Remove the internal DNS records

Names like admin., db. and vpn. come out of public DNS. Your public website's name stays.

4

Close the inbound ports

Last, and only once steps 1 to 3 are proven. From that moment an outside scan finds nothing.

What does not disappear

If customers or the public need to reach something — a website, an online shop, a public portal — that has to stay public, and it does. EdgeShield removes what should never have been exposed: admin panels, SSH, RDP, databases, internal tools. Most break-ins come through those, not through the website.

Devices that cannot run anything

Printers, a NAS, an old server, network gear — put Ikat on one machine in that network and it carries the rest. Nothing is installed on those devices at all.