Guardian for Digital Networks
Security for the connectivity layer
GURDN is a Windows application that watches how your machine connects: its DNS resolvers, routes, network adapters, Wi-Fi and firewall state. It detects changes that matter, explains them in plain terms, and can take protective action you authorise, verify and undo.
StatusGURDN is in release qualification. There is no public download yet, and this site will not offer one until the release gate passes. What that means.
Figure 1, conceptual architecture
The internet, your provider and the local network. Outside the machine, and outside what GURDN can change.
- DNS
- Routing
- Adapters
- Wi-Fi
- Firewall
- VPN state
Observes the whole layer, not one part of it
Compares what it reads with what this network looked like before, and correlates changes that happen together. Acts only where Windows allows it, only when authorised, and verifies by reading the machine back.
Windows
Owns the configuration. Where it exposes no capability, GURDN reports that the capability is not supported.
01The layer
Your machine trusts its network before it trusts anything else
Every name your computer looks up, every route its traffic takes and every network it joins is decided by a handful of settings. They change for ordinary reasons all the time, and they change for other reasons too. Very little watches them as one system.
02Coverage
What GURDN watches, and what it can change
Six surfaces. Each one says plainly whether GURDN only observes it, or can also act on it with your authorisation. Nothing here is a capability the product does not have.
Observes and acts
Which resolvers each interface is configured to use, and whether they changed from what GURDN last recorded.
Can set interface resolvers to a configuration you choose, then read them back to confirm.
GURDN does not recommend a resolver. Each one is operated by someone, and none lets GURDN verify that an answer is authentic.
Observes
The routing table, joined to the interface list, to name the path traffic actually takes.
Observation only.
Where several interfaces carry a default route, GURDN reports the ambiguity rather than guessing which one is in use.
Observes
Which interfaces exist, their type and status, their addresses, prefix lengths, DHCP origin, gateways and MTU.
Observation only.
An adapter hidden by a filter driver is not visible to the Windows IP Helper API, and so is not visible to GURDN.
Observes
The associated network, its security type, and how that compares with previous associations of the same network.
Observation only.
Without a resolvable gateway the network fingerprint rests on signals a nearby attacker can forge, and GURDN reports the identity as weak rather than claiming recognition.
Observes and acts
The host firewall profile in force and whether it is enabled, read from the local firewall policy store.
Can enable a profile, and can add and remove its own filters through the Windows Filtering Platform, inside a transaction.
A profile set by Group Policy is refused rather than written locally, because a local value the policy would override reads back unchanged.
Observes
Whether a VPN interface is present and carrying traffic.
Observation only.
GURDN reports presence. It is not a VPN, it does not provide one, and it does not vouch for any provider.
03Why it is built this way
Four ordinary changes can be one unusual event
Treating every change on its own is how a security tool becomes noise. GURDN groups changes that happen together and judges them as one thing, with the evidence attached.
Figure 5, correlation
- Resolver changedordinary on its own
- New adapter appearedordinary on its own
- Default route movedordinary on its own
- Firewall profile changedordinary on its own
One event, with its evidence
severity, confidence, and the inputs it used
Explained to you, in order
with what GURDN could not read also shown
04The loop
From reading the machine to a change you can undo
Seven stages, in order. Each exists because skipping it is how security software causes outages or claims protection it did not deliver.
Observe
Read the actual state from Windows.
Interfaces, addresses, routes, resolvers, Wi-Fi association, VPN presence and firewall profile, read through the Windows APIs that own them. GURDN does not probe the network or inspect traffic.
Understand
Compare against the baseline and the other observations.
Observations are normalised and diffed against what was recorded before. Each result carries whether it was collected, partly collected or unavailable, and why.
Decide
Judge whether the change is meaningful.
Rules evaluate the change against the baseline, the network trust level and what else changed at the same time. Every decision records which inputs it used and which were missing.
Authorise
Require the right authority before anything changes.
Nothing is applied because a rule fired. The required level of authority depends on the operation, consent is recorded, and the interface cannot grant itself more than it has.
Act
Make only the supported change, through the privileged service.
Operations are a defined set, not arbitrary commands. Where the platform supports it the change applies as one transaction, so a partial result cannot be left behind.
Verify
Read the machine back.
The change is confirmed against the same source GURDN reports state from. A call that returned success without a matching read back is treated as a failure.
Recover
Undo rather than leave the machine half changed.
Every step records its undo before it is attempted. On failure the completed steps are walked back in reverse, and a step whose current state no longer matches is refused rather than forced.
05Architecture
Almost nothing in GURDN runs with privilege
The interface has none. The engine that decides has none. A separate Windows service holds the rights needed to change configuration, and it is reachable only across one restricted local endpoint.
Figure 2, trust boundary
Desktop interface
Shows state, asks for authorisation. Holds no privilege.
Security engine
Observation, baseline, detection, trust, policy, response. Decides; cannot act.
Privileged Windows service
The few operations that need privilege, and nothing else.
Windows
Owns the configuration.
Tauri and React. Privilege: none.
Rust. Privilege: none.
Windows service, own restricted identity. Privilege: elevated, narrowly.
Filtering Platform, IP Helper, firewall policy store. Privilege: the platform.
06Response
A change that cannot be verified is undone
GURDN confirms a change by reading the machine back, not by trusting that the call returned success. If the read back disagrees, the recorded undo runs and the result is reported as a failure.
Figure 3, response lifecycle
- Capturerecord the current state and its undo
- Authoriserequired authority, recorded
- Applythrough the privileged service
- Verifyread the machine back
Commit
recorded as applied
Roll back
run the recorded undo, then report the failure and the state left behind
07Honesty
Unknown is a state, and it never becomes healthy
A question GURDN could not answer is reported as unanswered. This is the part of the product that is hardest to market and most useful to live with: a tool that only ever says you are fine has told you nothing.
08Local by design
No account, no cloud service, no mandatory telemetry
Observation, assessment, decisions and the record all happen on your machine. The privacy properties come from where the code runs, not from a policy promise.
The privacy page states exactly what is stored, where, and what leaves the machine.
09Comparison
GURDN is looking somewhere different
It is not an antivirus, not a VPN, and not a nicer window onto Windows Firewall. Being specific about that is more useful than claiming to be everything.
Antivirus
Focuses on files, processes, memory and the behaviour of code running on the machine.
Focuses on how the machine connects: resolvers, routes, adapters, Wi-Fi association and firewall state. The point is a different focus, not that other tools ignore networking.
A VPN
Provides connectivity, usually by routing traffic through a provider.
Provides no connectivity and routes nothing. It observes the connectivity the machine already has, and can report whether a VPN interface is present.
A firewall interface
Presents the rules Windows already holds, usually one rule at a time.
Correlates firewall state with the resolvers, routes and adapters around it, and puts any change inside an authorised, verified, reversible lifecycle.
A monitoring dashboard
Collects from many machines into a service, and usually requires an account and a backend.
Runs on one machine, keeps its record there, and needs no account and no server to function.
10Limits
What GURDN cannot do
A security product that describes only its strengths cannot be assessed. Most of these are permanent properties of running on one endpoint, not gaps waiting to be filled.
The full limitations page and the documentation go further.
11Documentation
Read the implementation before you trust it
Twenty pages covering observation, each surface, authorisation, the response engine, verification, recovery, the architecture, the security model, updates, privacy, installation and the limits.
12Availability
GURDN is in release qualification
The product is built and tested. It is not released, and until its release gate passes this site offers nothing to install. A security tool handed out before it has been validated is the opposite of the point.