Why dflux EdgeGuard

dflux EdgeGuard sits in front of the NFs you operate. Every request a consumer makes to a producer flows through the same pipeline, and both protocol planes — HTTP/2 SBI and Diameter over TCP/SCTP — share it. That single-pipeline design is what makes the proxy a good fit for some problems and the wrong fit for others. This page is the decision: read it before you commit.

When to pick dflux EdgeGuard

Reach for dflux EdgeGuard when:

• You need one policy across SBI and Diameter. A consumer that registers a UE on Nudm and updates a profile on S6a is one rule set in the proxy — not two stacks to keep in sync.
• You want to harden a multi-vendor signaling plane. The proxy terminates consumer connections, applies your rules, and re-originates the request — producers downstream never see consumer credentials.
• You need to transform or redact at wire speed. Strip identifiers from inbound traffic, inject correlation IDs, mask body fields for tenant isolation — all in a request and response phase, without touching the NFs themselves.
• You need a record of what was allowed and denied. Every decision is emitted as a structured JSON log line and counted in Prometheus metrics, so you can ship the decision stream to your log pipeline or SIEM and alert on allow/deny rates without instrumenting the NFs.
• You need to roll out producer changes safely. Drain a producer, shift weight, or run a canary with weighted targets — without restarting the proxy or touching consumer config.

When not to pick dflux EdgeGuard

• You need a working NF. dflux EdgeGuard is a proxy, not an AMF, SMF, or HSS. Stand up the real NF; put the proxy in front of it.
• You need a service mesh. The proxy focuses on 3GPP signaling; if you want mTLS-everywhere east-west for arbitrary microservices, a mesh fits better.
• You only need a load balancer. If a layer-4 LB suffices, the proxy is overkill. It earns its place when policy, transformation, or content-based routing matter.

Where to go next

• Overview — what the proxy does and how the two binaries run.
• Quickstart — install, run, and exercise the proxy in about 10 minutes.