SOHO & Personal Shield Documentation

Personal Security Cloud for Pro Users, Home Offices & Small Teams

Arx Cloud Personal Shield delivers enterprise-grade Zero Trust security, DNS threat sinkholing, ad/tracker blocking, and encrypted WireGuard mesh routing directly to your home network, remote laptops, and mobile devices—with zero complex network configuration.

Live SOHO Personal Shield View

PoP: pop-us-east.arxcloud.io (140.82.4.59)

Mesh Connection

Active & Protected

Assigned IP: 10.66.4.12/32

Ads & Trackers Blocked

14,820 queries (24h)

38% Bandwidth Saved

LAN Connector Status

Home Office Relay

192.168.1.0/24 (Bridged)

3-Minute Quickstart: Connect Your Device

Arx Cloud uses standard, high-performance WireGuard protocol. You do not need proprietary bloated clients. Any standard WireGuard client on Windows, macOS, Linux, iOS, or Android connects in seconds.

Setup Steps

1. Install WireGuard from wireguard.com or your app store.
2. Log into the Personal Shield Console.
3. Click Add Device and download your generated arx-shield.conf (or scan the mobile QR code).
4. Toggle the tunnel to Active. All traffic is instantly encrypted through the nearest global PoP.

arx-shield.conf (Sample)

[Interface]
PrivateKey = YOUR_DEVICE_PRIVATE_KEY
Address = 10.66.4.12/32
DNS = 10.66.0.1

[Peer]
PublicKey = gOApXHkCYDF+ltzrre5sJm8ZWuL83eXCWRzdB63hAD4=
PresharedKey = YOUR_256BIT_PRESHARED_KEY
Endpoint = pop-us-east.arxcloud.io:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

SOHO LAN Hardware Connector (Whole-Office Protection)

Want to protect every device on your home or office Wi-Fi (Smart TVs, IoT cameras, NAS servers, guest phones) without installing software on each one? Deploy the lightweight Arx Outbound Connector on any local Raspberry Pi, NAS, or home server.

Deploy via Docker (One-Liner)

docker run -d \
  --name arx-soho-connector \
  --restart unless-stopped \
  --net=host \
  --cap-add=NET_ADMIN \
  -e ARX_ENROLL_TOKEN="arx_conn_YOUR_ENROLLMENT_TOKEN" \
  -e ARX_LOCAL_LAN="192.168.1.0/24" \
  ghcr.io/arxcloud/connector:latest

Zero Open Ports Punches outbound over UDP 51820 or QUIC 443. No router port-forwarding needed.

Router DHCP Setup Set your router's primary DNS IP to the connector's local LAN IP (e.g. 192.168.1.50).

Automatic Failover Maintains sub-second heartbeat with global PoPs and auto-reconnects on ISP drops.

Ad, Malware & Tracking Sinkhole

Arx Cloud intercepts DNS queries at the edge PoP before bad packets reach your device. Known phishing domains, botnet C2 servers, telemetry beacons, and intrusive ad exchanges are instantaneously answered with 0.0.0.0.

Aggressive Ad & Tracker Blocking ON BY DEFAULT

Filters YouTube video ads, mobile in-app banners, Google/Meta cross-site tracking pixels, and smart-TV telemetry without breaking legitimate web browsing.

Family & Office Safe Mode OPTIONAL TOGGLE

Enforces Google & Bing SafeSearch, blocks adult/gambling categories, and restricts high-risk new top-level domains (.zip, .top, .buzz).

Pro Feature: BYO Egress & Exit Proxy Selection

Need your home office or remote contractor traffic to appear as coming from a specific office static IP or custom cloud VPS? You can bind your own SOCKS5/HTTPS egress proxy in the Personal Shield tab.

Navigate to Personal Shield > Egress Exit in your console and select your desired egress mode:

Direct PoP Clean Egress (Default): High-speed Anycast exit from the nearest regional data center.
Custom SOHO Gateway: Direct your traffic out through your primary office router's static public IP.
BYO Proxy (Residential / SOCKS5): Routes outbound web traffic through your own private proxy server for geo-testing or privacy.

Verification & Health Check

Test that your WireGuard tunnel or LAN connector is correctly routing traffic and intercepting threats with these quick commands:

1. Test Overlay Connectivity & Gateway Ping

ping 10.66.0.1

Should reply in <10ms directly from your regional PoP kernel.

2. Verify Threat DNS Sinkhole

nslookup malware-test.arxcloud.io

Should return Address: 0.0.0.0 (Threat successfully intercepted).

Enterprise SASE Administration Manual

Unified Zero Trust Architecture & Operations

Arx Cloud delivers single-pass policy inspection across 10 global Edge PoPs: Secure Web Gateway (SWG), Zero Trust Network Access (ZTNA), Cloud Access Security Broker (CASB), Deep DLP with Exact Data Match (EDM), ClamAV Malware Sandboxing, and Web Bastion SSH.

Executive NOC/SOC Console View

PostgreSQL RLS Active (23 Tables Isolated)

Protected Endpoints

2,480

100% Posture Compliant

Zero-Day Detonations

319

ClamAV Stream Analysis

DNS Threats Blocked

94,120

Sinkholed to 0.0.0.0

DLP Leaks Intercepted

EDM Fingerprint Match

15-Minute Admin Onboarding (Day 0)

Enterprise tenants are securely provisioned with strict PostgreSQL Row-Level Security (RLS) isolation and baseline out-of-the-box protections.

First-Login Security Enforcement

When a platform operator provisions your tenant via POST /api/v1/platform/onboard, your initial administrator receives a one-time temporary password. The Go control plane enforces that no API requests or dashboard features unlock until you rotate your password via /api/auth/change-password.

Pre-Configured Baseline Protections:

• Secure Web Gateway: Default blocks for C2, botnets, malware distribution, phishing.

• Deep DLP: 5 regex rules enabled out of the box (Payment cards, SSN, AWS secret keys, private keys, GitHub tokens).

• AI Guard: Blocks prompt-injection patterns and unauthorized LLM training telemetry.

Agentless SAML 2.0 Web SSO (Clientless Access)

Provide zero-install browser access to internal web apps (Jira, Confluence, internal admin panels, ERPs) through Arx Cloud's high-speed reverse proxy with SP-initiated SAML 2.0 federation against Microsoft Entra ID or Okta.

Assertion Consumer Service (ACS) URL https://app.arxcloud.io/saml/{app-slug}/acs

Entity ID / Audience URI https://app.arxcloud.io/saml/{app-slug}/metadata

Cryptographic Guarantees:

Strict RSA-SHA256 XML digital signature verification.
In-memory replay cache prevents assertion replay attacks (InResponseTo validation).
Strict SSRF protection: Target URLs resolving to cloud metadata (169.254.169.254) or PoP loopbacks are blocked at socket connect.

Hybrid Cloud Gateways & Overlapping RFC1918 NAT

Connect private clouds (AWS VPC, Azure VNet, Google Cloud VPC, On-Premises DCs) to the Arx Cloud mesh using standard WireGuard gateways.

Overlapping Subnet 1:1 Transit NAT Explained

18/18 VERIFIED ON LIVE POPS

In multi-tenant SASE networks, different corporate customers frequently use the exact same private RFC1918 subnets (e.g. Tenant A and Tenant B both run 192.168.77.0/24). Linux WireGuard cannot assign the same AllowedIPs prefix to two peers on one interface.

How Arx Cloud solves this:

When Tenant B enrolls an overlapping subnet, the control plane allocates a unique 1:1 transit prefix from CGNAT space (100.64.0.0/10), e.g. 100.100.1.0/24.

The regional PoPs install tenant-marked stateless prefix DNAT rules in nftables:

iifname "wg0" meta mark <mark> ip daddr 192.168.77.0/24 dnat ip prefix to ip daddr map { 192.168.77.0/24 : 100.100.1.0/24 }

The customer's connector performs the reverse mapping on ingress:

iifname wgc ip daddr 100.100.1.0/24 dnat ip prefix to ip daddr map { 100.100.1.0/24 : 192.168.77.0/24 }

Result: Both tenants route 192.168.77.0/24 simultaneously through the exact same PoP gateway with zero routing conflicts or packet leakage.

CASB API & Microsoft 365 Cloud Protection

Arx Cloud CASB connects directly to your Microsoft 365 tenant via Microsoft Graph API to inspect OneDrive for Business and SharePoint Online files and permissions.

Sharing Risk Classification

Automatically tags files shared with ANONYMOUS_LINK (anyone with link), EXTERNAL_SHARE (shared with external guest emails), and ORG_LINK.

One-Click Permission Revocation:

Instantly delete public anonymous links directly from the console without logging into Microsoft admin centers.

In-Memory DLP Scanning

Downloads inspectable text, CSV, and code files (up to 2 MiB) entirely in RAM. Evaluates them against your active DLP regex rules and Exact Data Match (EDM) indexes.

Privacy Guaranteed:

Files are scanned in volatile memory and never persisted to database or disk.

Exact Data Match (EDM) DLP Fingerprinting

Traditional regex DLP triggers false positives on random 16-digit numbers. EDM fingerprints your actual customer database or employee records using one-way HMAC-SHA256 hashes.

How it works: Upload a single-column CSV of sensitive values (e.g. customer credit card numbers, bank account numbers, or patient IDs).

1. The control plane hashes every value using HMAC-SHA256(value, ARX_DATA_KEY).

2. Only the first 16 bytes of each hash are stored in the edm_hashes table (protected by Postgres RLS).

3. Zero plaintext data is ever saved or readable by operators.

4. When traffic traverses the edge or CASB scans a file, tokens are hashed with the same key. A match triggers an immediate BLOCK.

Real-Time SIEM Streaming & Auditing

Stream all security events (ZTNA handshakes, SWG blocks, DLP violations, CASB detections) directly into your centralized SIEM/XDR.

Syslog over TLS (CEF)

Streams ArcSight Common Event Format (CEF) over verified TLS on port 6514.

Splunk HEC

Direct HTTP Event Collector integration with tenant-bound AES-GCM encrypted tokens.

HTTPS Webhooks

JSON event streaming to Microsoft Sentinel, Datadog, or custom webhook endpoints.