Everything you need to run Cloud Spectra in your own cloud account: the gateway appliance and the four relay products. If you are new, start with the gateway Quick Start; if you know what you need, the full table of contents lists every page.
1. Start here
1Deploy the
gateway into your AWS account. It takes about fifteen minutes, and NAT works the
moment it is up — nothing else has to be configured first.
2Pick the relay product
you need from the table below. Each one has its own Quick Start.
3Turn features
on from the dashboard. Everything in your tier is switchable without
redeploying.
2. Gateway
The appliance itself: a NAT gateway that replaces the cloud's metered one, with a firewall, intrusion detection, a web proxy, load balancing and an AI gateway available on top. It runs in your VPC and the traffic stays in your account.
- Quick Start — prerequisites, deploying with Terraform, first login, NAT out of the box, enabling a feature
- User Guide — the networking data plane, inspection and enforcement, the AI data plane, ElasticApps, monitoring, ports, IAM, upgrades
- Architecture — the design underneath
- FAQ and Known limitations
3. The four relay products
CloudVpn
Standard
Several devices share one public address from your own cloud account. The only relay mode that NATs.
CloudVpc
Advanced
Run compute in another cloud as an ordinary member of your AWS VPC — its private address, its metadata service, its IAM role.
CloudConnector
Advanced
An L3 pipe between clouds. Forwards with the source intact — no NAT, no address transfer.
4. Which product do I want?
The quickest way to choose is to ask what is moving — a device, or a network.
| If you want to… | Use | Because |
|---|---|---|
| Reach a private database from your laptop without a bastion | CloudAddress | The device wears the relay's address and dials the private one directly |
| Hold one stable public IP for someone else's allow-list | CloudAddress | One device, one address, and the allow-list entry never changes |
| Put a whole team behind one egress IP | CloudVpn | Several devices share one public address — the only relay mode that NATs |
| Run GPU or cheaper compute from another cloud in your existing cluster | CloudVpc | The far machine is an ordinary member of your VPC, with its metadata and IAM role |
| Let a service in one cloud's VPC talk to one in another | CloudConnector | An L3 pipe that forwards with the source intact — no NAT |
| Replace the cloud's NAT gateway and stop paying per GB | Gateway | NAT works out of the box the moment the appliance is deployed |
CloudAddress or CloudVpn? CloudAddress gives one device
an address it wears, so it can be reached. CloudVpn puts several devices behind one
address and translates their flows. If something needs to reach in, you want CloudAddress.
CloudVpc or CloudConnector? CloudVpc moves compute
— individual machines join your VPC. CloudConnector moves traffic — two
networks are joined and nothing changes identity.
5. Full table of contents
Gateway
- Quick Start — deploy into your AWS account
- User Guide — every feature, what it replaces, how to turn it on
- Architecture — how the pieces fit together
- FAQ
- Known limitations
CloudAddress
- Overview — what it is and when to use it
- Quick Start — get one running
- User Guide — day-to-day operation
- FAQ — and its limits
CloudVpn
- Overview — what it is and when to use it
- Quick Start — get one running
- User Guide — day-to-day operation
- FAQ — and its limits
CloudVpc
- Overview — what it is and when to use it
- Quick Start — get one running
- User Guide — day-to-day operation
- FAQ — and its limits
CloudConnector
- Overview — what it is and when to use it
- Quick Start — get one running
- User Guide — day-to-day operation
- FAQ — and its limits
6. Find a feature
Where each shipping feature is documented. Features still in development appear in the dashboard catalog with their status rather than here.
| Feature | Tier | Documented in |
|---|---|---|
| Source NAT, destination NAT / port forwarding | Standard | User Guide → Networking data plane |
| Network Load Balancer (IPVS L4), TLS termination | Standard | User Guide → NLB |
| Forward HTTP proxy + caching (Squid) | Standard | User Guide → Web proxy |
| Vertical and horizontal scaling, per-AZ Auto Scaling | Standard | User Guide → Scaling |
| Sticky ENI, sticky EBS, per-slot route table | Standard | User Guide → Networking data plane |
| nftables firewall, Suricata IDS/IPS, TLS inspection | Advanced | User Guide → Inspection & enforcement |
| Domain, URL and category filtering; L7 App-ID; antivirus | Advanced | User Guide → Filtering |
| Threat feeds, ET Open, SIEM export | Advanced | User Guide → Threat detection |
| AI LLM proxy, response and semantic cache | Advanced | User Guide → AI data plane |
| Kubernetes and GPU worker images, ElasticApps | Standard | User Guide → ElasticApps |
| CloudAddress | Standard | CloudAddress |
| CloudVpn | Standard | CloudVpn |
| CloudVpc | Advanced | CloudVpc |
| CloudConnector | Advanced | CloudConnector |
7. Getting help
- Each product has its own FAQ, linked above, covering that product's limits.
- Known limitations lists what the current release does not do, in one place.
- Architecture explains what is happening underneath when the surface behaviour is not enough.