LUFITOSite-to-site VPN · Remote access · One gateway
The bank wants a VPN tunnel before they’ll connect you.
Lufito is the gateway that gives you one — and the next one, and the one after that. Every client, every partner and every device kept apart by default, on a server you own.
Each client gets its own address range the moment it is created. The firewall is built from that inventory on every apply, so a client that has not been granted something cannot reach it — including by accident.
What it is for
Three jobs, one box, no network team
Most businesses meet this problem sideways. A partner integration stalls, staff can’t reach the office, or a piece of equipment turns out to speak a protocol from 2009.
A partner demands a tunnel
Banks, insurers and payment processors will not put your traffic on the public internet. They send a parameter sheet and expect IKEv2 with matching proposals. Lufito answers it, and the next one, from the same gateway.
Your people are not in the office
Laptops and phones join by WireGuard — a phone is set up by scanning one code. Servers get a split tunnel that routes only what they need, so nothing else about them changes.
Equipment that cannot keep up
A PBX or an old appliance that speaks only OpenVPN still joins its owner’s network, under the same rules as everything else. Nothing gets an exemption for being old.
The part that matters
Sharing a gateway should not mean sharing a network
The cheap way to run many clients on one box is to put them all on the same network and hope nobody goes looking. It works until it doesn’t, and you find out from the client.
Lufito builds its firewall from the client inventory every time it applies. Each client has its own address range. A rule exists only where access has been granted, and everything else meets a closing deny.
Traffic crossing a tunnel is governed twice more: one list for what you may start with a partner, another for what they may start with you. Both are empty until somebody writes a line, so a new tunnel comes up carrying nothing at all.
That has a consequence worth stating plainly. If part of the inventory cannot be read, the devices it describes are simply absent from the rules — and absent means denied. A fault costs connectivity, never separation.
# each client reaches its own -s 10.242.1.0/24 -d 10.242.1.0/24 RETURN -s 10.242.2.0/24 -d 10.242.2.0/24 RETURN # and its own tunnel, nobody else's -s 10.242.1.0/24 -o ipsec1 RETURN -s 10.242.2.0/24 -o ipsec2 RETURN # everything else -d 10.242.0.0/16 DROP -o ipsec+ DROP
Specification
Boring, current cryptography
Chosen to negotiate with equipment that is already in the field, rather than to look modern on a slide.
Site to site
- Protocol
- IKEv2, strongSwan
- Phase 1
- AES-256, SHA-256, DH group 14
- Phase 2
- ESP, AES-256, SHA-256, PFS
- Per tunnel
- own interface, own address, own rules
- Dead peers
- detected and restarted
Remote access
- Protocol
- WireGuard, dual stack
- Setup
- one QR code, or a config file
- Servers
- split tunnel, only the routes they need
- Fallback
- OpenVPN for appliances
- Revocation
- immediate, per device
Operating it
- Console
- web, reachable only over the VPN
- Accounts
- per client, scoped server-side
- Passwords
- scrypt, sessions revocable
- Record
- every change, with who and when
- Also
- a command line that does everything
Nothing proprietary and no vendor extensions — standard IKEv2 with proposals mainstream gateways already accept, so the other end does not have to be Lufito.
Where it runs
On your server, with your keys
Lufito installs onto a plain Ubuntu machine — your own hardware, or a virtual server from any provider. There is no Lufito cloud in the middle, no account to depend on, and no third party holding the keys to your partners.
The installer refuses rather than guesses: it will not run where the kernel cannot carry a tunnel, and it will not take an address range that collides with something already routed.
If you would rather not run it yourself, Sihebs operates it for you on the same terms.
$ sudo ./install.sh --dry-run checking kernel, python, addresses… ok xfrm and wireguard available ok 10.242.0.0/16 is free ok udp 500, 4500, 51820 admitted $ sudo ./install.sh done gateway ready $ lufito device add crm --tenant cl_04 created crm at 10.242.4.2
Who it is for
Businesses with partners, not network departments
Microfinance and lending
Core banking links, credit bureau connections, and a branch network that has to reach both without either seeing the other.
Health and insurance
Claims integrations with several funds at once, where each counterparty expects its own tunnel and its own terms.
Call centres and BPO
Phone systems that must reach a customer’s CRM, and agents who need the office network from wherever they are working.
Anyone integrating with a bank
If a parameter sheet has landed in your inbox and nobody in the building knows what a proposal is, this is the shortest way to answer it.
Tell us who you need to reach
Send us the parameter sheet your partner gave you, or just describe the problem. We will tell you what it takes — including when the answer is that you don’t need us.
- info@sihebs.co.tz
- Phone
- +255 756 532 635
- +255 796 296 796
- Web
- www.sihebs.co.tz
Victoria House, 5th Floor, Wing B
Plot 37, Regent Estate, New Bagamoyo Road
P. O. Box 33073, Dar es Salaam, Tanzania