CHARON SOURCE-AWARE POLICY ROUTER

ROUTED POLICY HOP

Every source gets
the right crossing.

Charon directs matching IPv4 traffic to an explicit gateway, sends ordinary traffic to the primary path, and stops safely when policy cannot be satisfied. Original source addresses remain intact.

Trace the route See the safeguards
  • Ubuntu gateway
  • Source policy
  • No NAT
ROUTING CONTRACT DECISIONSOURCE-AWARE FORWARDINGNO NAT
Longest prefixfirst match
Explicit prioritytie breaker
Health-gatedgateway use
Fail closedor chosen backup

THE OPERATING IDEA

Choose by source.
Preserve the source.

Charon sits between the core and upstream gateways. The core keeps its VLAN interfaces; Charon owns only the policy decision and the network state required to enforce it.

01

Classify

Match the original source network using longest-prefix order, then explicit priority.

02

Select

Use the configured primary gateway, a named alternate, or the reserved DROP policy action.

03

Verify

Compare desired policy with live routes, rules, firewall objects, probes, and packet evidence.

PACKET PATH

Intent becomes one
explicit route.

Charon makes one deterministic decision for forwarded traffic. Unmatched sources use the primary gateway; matching sources use the selected healthy path.

  1. 01
    Receive from the core

    Keep the packet's original source address and forwarded ingress identity.

  2. 02
    Apply source policy

    Resolve overlapping CIDRs by prefix length and explicit rule priority.

  3. 03
    Check eligibility

    Require the configured health policy and observed kernel route state to agree.

  4. 04
    Choose the outcome

    Forward through the selected gateway, use its named backup, or fail closed.

  5. 05
    Prove the path

    Expose desired and observed state separately so disagreement stays visible.

SOURCE NETWORKS
192.168.10.0/24 192.168.20.0/24 UNMATCHED
POLICY HOP CHARON
PRIMARY GATEWAY ALTERNATE GATEWAY POLICY DROP

One interface. Multiple explicit outcomes. No address translation.

GATEWAY CONTROL

Healthy is an agreement,
not a green badge.

A gateway is eligible only when its configured probe policy and the observed route state agree. Charon supports ICMP, TCP, and HTTP probes with adjustable transition thresholds.

DEFAULT 5 seconds

Probe interval

TIMEOUT 2 seconds

Per attempt

UNHEALTHY 3 failures

Consecutive

RECOVERED 2 successes

Consecutive

Every value is configurable per gateway. Backup chains are permitted only when the complete relationship is acyclic.

OPERATIONAL ASSURANCE

Safety lives in the
data plane.

Charon does not convert a saved configuration or passing test into a health claim. It reports the authoritative state that is actually forwarding traffic.

01

Transactional apply

Validate before activation and preserve or restore the last known-good routing state on failure.

02

Narrow privilege

An unprivileged control process delegates bounded mutations to a protected network worker.

03

Fail-closed policy

Unusable gateways never create an implicit fallback. Traffic stops or follows the configured backup.

04

Observed evidence

Routes, rules, firewall state, services, probes, and desired revision remain independently visible.

PRODUCT BOUNDARIES ROUTED HOPNO NATIPV4 POLICYSTATIC REQUIREDTLS + PAM
Charon passage-obol product mark

BUILT-IN RESILIENCE

Recovery is part of the crossing.

Charon reconstructs its owned policy routes and firewall objects after restart, preserves confirmed management identity, and keeps policy routing disabled until a static address is confirmed.

Management
TLS with PAM authentication
Policy state
SQLite desired configuration
Enforcement
iproute2 and nftables
CURRENT RELEASE 0.1.7

CHARON BY ANTIDESIGN SOFTWARE

Deliberate routing.
Visible evidence.

Built for network operators who need explicit source policy, predictable failure behavior, and a management surface that distinguishes configuration from reality.

  • Ubuntu 26.04 LTS
  • AMD64
  • Single-interface routed hop