Every release is built in the XaasIO DevSecOps pipeline and delivered as signed packages and appliance images with an upstream and XaasIO SBOM, license and vulnerability review, and SPDX or CycloneDX outputs.
XaasIO NFV · Network Functions Virtualization
Software-Defined Networking and Network Functions, From Overlay to Edge
Overlay networks for east-west traffic on Open vSwitch with VXLAN, and virtual network functions for everything else: routing, firewalling, UTM, IPsec VPN, load balancing, SD-WAN, road-warrior VPN and zero-trust access. On your infrastructure. With XaasIO lifecycle support and production SRE.
XaasIO NFV gives a private cloud the distributed virtual switch that VMware vNetwork Distributed Switch and Cisco Nexus 1000V gave vSphere, built on Open vSwitch, and adds the network functions as validated virtual appliances: OPNsense for firewall, UTM and IPsec VPN, HAProxy for load balancing, NetBird for SD-WAN and road-warrior VPN, and Netmaker for zero-trust networking. Every tenant network, function and policy is defined once and delivered the same way on XaasIO Compute, XaasIO Virtualization, XaasIO HCI and XaasIO Kubernetes.
Open source by default: Open vSwitch, OPNsense, HAProxy, NetBird, Netmaker and WireGuard, delivered as signed packages and appliance images with an SBOM per release. Customer-operated, co-managed or fully managed by XaasIO. Runs in your data center, sovereign cloud, provider region or air-gapped site.
Architecture
One overlay, one function catalog, five layers
From the teams that define tenant networks and policies down to the leaf-spine fabric the servers plug into: how one XaasIO platform switches east-west traffic, inserts network functions and connects sites and users, under one identity and one lifecycle.
One overlay, four function families
One platform.
East-west switching and every north-south function.
Virtual machines and containers talk to each other far more than they talk to the outside world. That east-west traffic needs a distributed virtual switch that spans every host, isolates tenants and never hairpins through an appliance. Everything that crosses a boundary, to the internet, between sites, from remote users, through a firewall or a load balancer, needs a network function with a lifecycle of its own.
XaasIO NFV separates the two cleanly. Open vSwitch carries east-west traffic in VXLAN-encapsulated overlays across all hosts. The network functions run as validated virtual appliances inserted where policy says: OPNsense for routing, firewalling, UTM and IPsec, HAProxy for load balancing, NetBird for SD-WAN and road-warrior VPN, and Netmaker for zero-trust access. One catalog, one identity and one release cycle cover all of it.
East-west traffic · overlay networks
Distributed Virtual Switch on Open vSwitch
- Tenant networks as VXLAN-encapsulated overlays that span every host, so a VM keeps its network when it live-migrates and no VLAN has to be stretched across the fabric
- The role VMware vNetwork Distributed Switch and Cisco Nexus 1000V play in vSphere: one logical switch with consistent port groups, policies and uplinks across the cluster
- Standard 802.1Q VLAN trunking, LACP bonding with source-MAC, active-backup and L4 hashing, STP and RSTP, BFD and 802.1ag link monitoring, IPv
- Fine-grained QoS, per-interface policing, HFSC queuing; visibility into VM-to-VM traffic through NetFlow, sFlow, IPFIX, SPAN, RSPAN and GRE-tunneled mirrors
- OpenFlow and OVSDB programmability, a multi-table pipeline with flow caching, kernel or user-space datapath with DPDK where latency matters; Geneve and GRE available beside VXLAN, with IPsec on tunnels where required
North-south traffic · security and VPN
Router, Firewall, UTM and IPsec VPN with OPNsense
- Stateful inspection firewall with granular state-table control, NAT, static and dynamic routing, DHCP, DNS and dynamic DNS for every tenant edge
- Unified threat management: inline intrusion detection and prevention with Emerging Threats rule categories, web application control, forward caching proxy with blocklists, captive portal with vouchers
- IPsec site-to-site VPN to partners and legacy firewalls, plus IPsec and OpenVPN client profiles for devices that cannot run the NetBird client; WireGuard available as a plugin for peer-to-peer tunnels
- High availability and hardware failover with configuration and state-table synchronization and moving virtual IPs, so a tenant edge survives a host failure
- Traffic shaper, 802.1Q VLANs, built-in reporting and monitoring (System Health, packet capture, NetFlow), configuration history with diff, backup and restore, and an API for every setting
Application delivery · load balancing
Load Balancing with HAProxy
- Layer 4 TCP and Layer 7 HTTP load balancing for applications on virtual machines and containers, with virtual IPs per tenant and service
- TLS termination and re-encryption, HTTP/2, content switching and ACL-based routing, header rewriting, redirects and compression
- Active and passive health checks, weighted and least-connection balancing, session persistence with stick tables, connection queuing and rate limiting
- Active-standby pairs behind a floating VIP, zero-downtime reloads, and a runtime API for draining and weighting servers without a restart
- Statistics page and Prometheus metrics into XaasIO MLT; ingress for XaasIO Kubernetes clusters and the load balancer service for XaasIO Compute tenants
Sites, clouds and users · SD-WAN and zero trust
SD-WAN and Road-Warrior VPN with NetBird, Zero-Trust Networking with Netmaker
- NetBird for SD-WAN and road-warrior VPN: encrypted WireGuard point-to-point tunnels between sites, clouds, devices and remote users, peer to peer where possible and relayed when a direct path is not, with a self-hosted management, signal and relay plane
- Network routes publish site and cloud subnets through routing peers, so data centers, branch sites and public cloud VPCs reach each other without a hub appliance; remote users join from laptops and phones with the NetBird client and single sign-on, with access control policies, private DNS and setup keys for machines
- Netmaker for zero-trust networking: WireGuard virtual networks with a mesh overlay, multi-network segmentation, access control lists and conditional access, so users and services reach only what policy allows
- Remote access gateways for users, egress gateways to networks the mesh cannot join, relays for hard-to-reach peers, DNS, and an IoT client gateway for devices
- Both run inside your boundary with your identity, log every connection into XaasIO MLT, and replace the appliance-centric VPN model with per-identity, per-service access
Every function shares the same tenant model, identity and audit trail as the overlay, so a tenant network, its edge firewall, its load balancer VIPs and its site and user access are one record in the catalog.
Function catalog
What each function does, and what it stands in for
| Function | XaasIO NFV component | Plays the role of | Delivered as |
|---|---|---|---|
| Distributed virtual switch | Open vSwitch on every host, programmed by the control plane | VMware vNetwork Distributed Switch, Cisco Nexus 1000V | Host software, part of every XaasIO Compute, Virtualization and HCI node |
| Overlay networks and segments | Open vSwitch VXLAN (Geneve and GRE optional) | NSX segments and VXLAN or Geneve overlays | Allocated per tenant network; VNI per segment |
| Micro-segmentation | Security groups enforced in Open vSwitch per port | NSX Distributed Firewall (stateful rules per VM) | Policy in the catalog; enforced on the overlay, no appliance in the path |
| Router, NAT and edge firewall | OPNsense | NSX gateway firewall and edge, vShield Edge, hardware firewalls | HA appliance pair per tenant or shared edge with virtual contexts |
| UTM: IDS and IPS, web filtering, captive portal | OPNsense with Suricata, proxy and captive portal | UTM and next-generation firewall appliances | Enabled on the tenant edge; rule sets updated with the release |
| IPsec VPN | OPNsense IPsec (strongSwan) and OpenVPN; WireGuard plugin | NSX VPN, firewall VPN modules | Site-to-site tunnels to partners and legacy firewalls; IPsec and OpenVPN clients where WireGuard is not possible |
| Load balancer | HAProxy | NSX Advanced Load Balancer, F5 BIG-IP, Citrix NetScaler | HA pair behind a floating VIP; Octavia-compatible service on XaasIO Compute; Kubernetes ingress |
| SD-WAN between sites and clouds | NetBird | SD-WAN appliances and hub-and-spoke VPN concentrators | Self-hosted management, signal and relay; routing peers per site |
| Road-warrior VPN | NetBird clients with single sign-on (OPNsense IPsec and OpenVPN as fallback) | Remote-access VPN concentrators and SSL VPN appliances | NetBird client on laptops, phones and servers; policies per user and group |
| Zero-trust network access | Netmaker | ZTNA products | Self-hosted server, remote access and egress gateways, ACLs per identity |
| Flow visibility | Open vSwitch NetFlow, sFlow and IPFIX into XaasIO MLT | vRealize Network Insight, flow collectors | Exported from every host; dashboards per tenant |
“Plays the role of” names the product category a function replaces in a typical estate. It is not a feature-for-feature claim; the assessment maps the features you use to the functions here and marks what is partial.
PLATFORM COMPONENTS
Everything needed to deliver networking as a cloud service
Overlay and Distributed Switching
VXLAN-encapsulated tenant networks on Open vSwitch across every host: segments, trunks, bonds, QoS, mirroring and flow telemetry, programmed through OpenFlow and OVSDB by the control plane.
Open vSwitch · VXLAN and Geneve · OpenFlow and OVSDB · Neutron ML2 OVS or OVN · DPDK option
Network Function Catalog and Service Insertion
Routers, firewalls, VPN gateways, load balancers, SD-WAN and zero-trust gateways published as catalog items per tenant, inserted on a network or between segments, and chained where traffic must pass more than one function.
Catalog items · Service insertion and chains · Per-tenant quotas · Approvals through XaasIO CMP (optional)
Appliance Lifecycle and High Availability
Validated OPNsense, HAProxy, NetBird and Netmaker images with sizing profiles, active-standby pairs with floating virtual IPs, anti-affinity across hosts, configuration backup, and upgrades under the XaasIO release cycle.
Appliance images per release · CARP and keepalived VIPs · Anti-affinity · Configuration history · Signed updates
Tenancy, Identity and Policy
Tenants, projects and roles mapped to your directory and single sign-on; security groups and firewall policies per tenant; access control policies for SD-WAN and zero-trust networks evaluated against the same identities.
XaasIO IAM · SAML, OIDC, LDAP and Active Directory · Security groups · Policy per tenant · Audit trail
Visibility and Observability
NetFlow, sFlow and IPFIX from the overlay, firewall and IDS events, load balancer statistics and VPN session logs collected by XaasIO MLT, with per-tenant dashboards, alerts and packet capture on demand.
OVS flow export · OPNsense NetFlow and Suricata events · HAProxy Prometheus metrics · NetBird and Netmaker activity logs · XaasIO MLT
Automation and APIs
Every network, function and policy is available through REST APIs, OpenStack Neutron on XaasIO Compute, Ansible collections for OPNsense and HAProxy, and OpenTofu or Terraform providers, so network changes ship like code.
REST APIs · Neutron API · Ansible collections · OpenTofu and Terraform · GitOps through the XaasIO Unified Automation Platform
ACCESS METHODS
Consume networking the way your platform already works
Tenants create networks and order functions from the console or the catalog. Operators use the appliance interfaces when they need to. Platform teams automate through APIs, Ansible and infrastructure as code. The same identity, policy and audit trail apply to every path.
HOW IT WORKS
One request. From tenant network to connected, protected, observed service.
01
Define
A tenant creates networks and segments with address ranges, security groups and QoS. XaasIO NFV allocates VXLAN identifiers and programs Open vSwitch on every host the tenant can use.
02
Attach
Virtual machines and containers join the overlay through their ports. East-west traffic between them stays on the distributed switch, isolated per tenant, and follows a VM when it live-migrates.
03
Insert
The tenant orders an edge: an OPNsense router and firewall with NAT and IPsec, a HAProxy load balancer with VIPs and health checks, or both in a chain. Appliances deploy as HA pairs from validated images.
04
Connect
Sites and clouds join through NetBird network routes and road-warrior users through the NetBird client; users and services get zero-trust access through Netmaker gateways and access control lists, all authenticated by your identity provider.
05
Observe and operate
Flows, firewall and IDS events, load balancer statistics and VPN sessions arrive in XaasIO MLT. Day-2 changes run as Ansible jobs from XaasIO CMP; upgrades follow the release cycle.
Tenants request networks and functions. XaasIO NFV owns the overlay, the appliance lifecycle, the policy and the audit trail. Open vSwitch switches, OPNsense protects, HAProxy balances, NetBird and Netmaker connect.
Traffic flows
East-west, north-south, site-to-site and user access, each on the right path
Most traffic in a private cloud never leaves the overlay. The functions sit where a boundary is crossed, and nothing else passes through them. That is what keeps the firewall and the load balancer out of the path of every VM-to-VM packet, and what keeps the overlay simple.
The flows below are the four XaasIO NFV designs for. Micro-segmentation inside the overlay uses security groups enforced in Open vSwitch; inspection between zones uses OPNsense; application traffic enters through HAProxy; everything remote, sites and road-warrior users alike, comes in over WireGuard.
Works with the XaasIO platforms
The network layer of every XaasIO private cloud
XaasIO NFV is the networking inside XaasIO Compute, Virtualization and HCI, the load balancer and ingress for XaasIO Kubernetes, and a catalog of governed network services in XaasIO CMP and the XaasIO Hyperscaler Platform.
Neutron networks, routers, security groups and floating IPs on XaasIO Compute
OVS bridges, VLANs and VXLAN on XaasIO Virtualization and HCI
HAProxy ingress and LoadBalancer services for XaasIO Kubernetes
Network catalog items and Ansible Day-2 runbooks in XaasIO CMP
Flow telemetry, events and dashboards in XaasIO MLT
Metered network services in the XaasIO Hyperscaler Platform
XaasIO Compute
OpenStack Neutron with the ML2 Open vSwitch or OVN driver for tenant networks, OPNsense as the tenant router and firewall option, HAProxy behind the load balancer service, floating IPs from the provider edge.
XaasIO Virtualization and HCI
Open vSwitch bridges on every KVM host with VLAN and VXLAN networks, OPNsense edges per cluster or per tenant, HAProxy for VM-hosted applications: the NSX path of the VMware migration.
XaasIO Kubernetes
HAProxy as the ingress controller and the LoadBalancer service provider, NetBird or Netmaker for cluster-to-cluster and operator access, security groups for node networks.
XaasIO CMP and Hyperscaler Platform
Networks, edges, load balancers and SD-WAN connections as catalog items with approvals, Day-2 runbooks in Ansible, and usage metered and billed for service providers.
PLANNING TOOL
Size the overlay and the edges
Tenant networks, edge pairs and load balancer pairs are counted, not guessed. Enter how many tenants you expect, how many networks each needs and how you want edges shared, and the planner returns the VXLAN segments, address space and appliance pairs the design starts from. Throughput and latency come from the assessment, not from this tool.
Overlay and edge planner
VXLAN segments1
Address space/29 per network, /29 total
OPNsense HA pairs1
HAProxy HA pairs1
NetBird routing peers2
Appliance VMs6
Planning estimate only. One VXLAN segment per network; the smallest subnet that fits the addresses plus gateway and reserved addresses; two appliances per HA pair; two NetBird routing peers per site for redundancy. Open vSwitch supports far more segments than any estate needs; the limits that matter are appliance sizing and host placement, which the assessment settles.
DEPLOYMENT MODELS
Choose the design that fits the estate
Private Cloud Networking
Neutron tenant networks on the Open vSwitch overlay, OPNsense tenant edges, HAProxy load balancer service and floating IPs on XaasIO Compute, with self-service through the console and API.
Enterprise Virtualization Networking
The distributed virtual switch for XaasIO Virtualization and HCI clusters, VLAN and VXLAN networks, cluster edges and application load balancers: the network side of a VMware exit.
Service Provider Multi-Tenant Edge
Tenant-isolated overlays, per-tenant OPNsense and HAProxy pairs or shared edges with virtual contexts, public IP pools, metered through the XaasIO Hyperscaler Platform.
Multi-Site, Sovereign and Air-Gapped
Sites joined by NetBird routes or IPsec, remote users on the NetBird client, zero-trust operator access through Netmaker, all control planes self-hosted inside the boundary, with signed offline updates where there is no internet path.
WHAT IS INCLUDED
One platform. The XaasIO platforms around it.
XaasIO NFV is delivered with the XaasIO platform it serves. Its functions run as appliances on XaasIO Compute, Virtualization or HCI, and the other platforms add the catalog, the telemetry and the billing.
XaasIO NFV
Included: the Open vSwitch overlay and distributed switch, the function catalog and service insertion, validated OPNsense, HAProxy, NetBird and Netmaker appliance images with HA profiles, APIs, Ansible collections and the release cycle.
XaasIO MLT
Optional, recommended: flow telemetry, firewall and IDS events, load balancer metrics and VPN session logs with per-tenant dashboards and alerts.
XaasIO Compute, Virtualization and HCI
Required host platform: the hypervisors the overlay spans and the appliances run on. Any one of the three, or a mix under one XaasIO CMP.
XaasIO CMP and Hyperscaler Platform
Optional: network functions as governed catalog items with approvals and Day-2 automation, and, for providers, rating, invoicing and payments.
OPERATING MODEL
Software-defined networking without the integration burden
XaasIO designs, deploys, validates and supports XaasIO NFV as one production platform rather than a collection of switches, appliances, scripts and tunnels.
Validated Architecture
Overlay, control plane, appliance images, HA pairs, placement rules, identity and telemetry sized and tested as one architecture on the XaasIO host platforms.
Controlled Lifecycle
Documented release, patching, upgrade, compatibility, rollback and maintenance procedures for Open vSwitch, OPNsense, HAProxy, NetBird and Netmaker, with every version pinned per release.
Secure Software Supply Chain
Flexible Operating Model
Customer-operated, co-managed, fully managed, or a dedicated XaasIO SRE Pod with 16×5 or 24×7 coverage.
Advanced Networking Support Packs
NSX Exit Pack
Segment, firewall-rule and load-balancer inventory from NSX, mapping to the overlay and the functions, wave plan with the VMware migration
Firewall Policy Migration Pack
Rule sets from NSX, vShield, Fortinet, Palo Alto, Check Point or Cisco ASA translated and tested on OPNsense
Load Balancer Migration Pack
Virtual servers, pools, health checks and TLS policies from F5, NetScaler or NSX Advanced Load Balancer rebuilt on HAProxy
Multi-Site SD-WAN Pack
NetBird management plane, routing peers per site, cloud VPC routes, road-warrior client rollout with SSO, failover tests and runbooks
Zero-Trust Access Pack
Netmaker networks, gateways and ACLs per team and service, identity provider integration, replacement of flat VPN access
Performance Pack
DPDK datapath, SR-IOV, NIC bonding and NUMA-aware placement for throughput-sensitive tenants, with measured results
Which function for which job
OPNsense, HAProxy, NetBird or Netmaker?
Different jobs. They work together.
| Dimension | OPNsense | HAProxy | NetBird | Netmaker |
|---|---|---|---|---|
| Role | Router, firewall, NAT, UTM and IPsec VPN for a tenant or cluster edge | Layer 4 and 7 load balancing and TLS termination for applications | SD-WAN and road-warrior VPN: WireGuard mesh between sites, clouds, devices and users | Zero-trust access: WireGuard virtual networks with gateways and ACLs |
| Typical placement | Between a tenant overlay and the provider edge, or between zones | In front of VM or container application pools, behind a VIP | A routing peer per site or VPC, management plane in your cloud | Gateways at the edge of each network, server in your cloud |
| Traffic it carries | North-south and inter-zone traffic | Client-to-application traffic | Site-to-site, cloud-to-cloud and remote-user traffic | User-to-service and service-to-service access |
| Protocols and standards | IPsec, OpenVPN, WireGuard plugin, BGP and OSPF plugins, NetFlow | TCP, HTTP/1.1, HTTP/2, TLS, PROXY protocol | WireGuard, ICE for peer discovery, relay fallback | WireGuard, DNS, ACLs |
| High availability | CARP pair with configuration and state synchronization | Active-standby pair with floating VIP, zero-downtime reload | Redundant routing peers; relay fallback | Multiple gateways, relays; failover in enterprise edition |
| Identity | Local users, LDAP, RADIUS, one-time passwords | Not user-facing; TLS client certificates where required | Single sign-on through your identity provider; setup keys for machines | OIDC users; keys per device; conditional access |
| Managed by | XaasIO NFV catalog, OPNsense API, Ansible collection | XaasIO NFV catalog, runtime API, Ansible collection | NetBird management dashboard and API | Netmaker server dashboard and API |
| Stands in for | Edge and gateway firewalls, UTM appliances, IPsec VPN gateways | Hardware and virtual application delivery controllers | SD-WAN appliances, hub-and-spoke VPN, remote-access VPN concentrators | ZTNA services |
KEY TERMS
Glossary
Networking terms used on this page.
Overlay and underlay
The underlay is the physical IP fabric between hosts. An overlay is a virtual network carried on top of it in tunnels, so tenant networks can span hosts without touching the physical switch configuration.
VXLAN and VNI
Virtual Extensible LAN encapsulates Ethernet frames in UDP so that a Layer 2 segment can cross a routed fabric. Each segment is identified by a 24-bit VXLAN Network Identifier, which allows about 16 million segments.
Open vSwitch
An open-source, production-quality multilayer virtual switch that runs on every host, supports VLANs, tunnels, QoS, mirroring and flow export, and is programmed through OpenFlow and OVSDB.
Distributed virtual switch
One logical switch whose ports, policies and uplinks are consistent across all hosts in a cluster, so a virtual machine keeps its network settings wherever it runs. vNetwork Distributed Switch and Nexus 1000V are the VMware-era examples.
East-west and north-south
East-west traffic flows between workloads inside the data center; north-south traffic crosses the boundary to the internet, other sites or users.
Network function
A networking service delivered in software rather than as a dedicated box: a router, firewall, VPN gateway, load balancer or SD-WAN endpoint running as a virtual appliance.
UTM
Unified threat management: a firewall that also performs intrusion detection and prevention, web filtering and related inspection in one appliance.
CARP and VIP
The Common Address Redundancy Protocol lets two OPNsense appliances share a virtual IP address; if the primary fails, the standby takes the address over, with the state table already synchronized.
SD-WAN
Software-defined wide-area networking: encrypted overlay connections between sites and clouds managed centrally, independent of the circuits underneath.
Zero-trust network access
Access granted per identity and per service after authentication and policy checks, instead of placing a user on a network and trusting everything on it.
WireGuard
A modern VPN protocol built into the Linux kernel, using fixed, audited cryptography and a small code base. NetBird and Netmaker build their networks on it.
DPDK
The Data Plane Development Kit moves packet processing out of the kernel into user space for higher throughput and lower latency on the Open vSwitch datapath.
Frequently asked questions
What is XaasIO NFV?
XaasIO NFV is the software-defined networking and network functions platform of the XaasIO private cloud. It carries east-west traffic in VXLAN overlays on Open vSwitch across every host, and delivers the network functions as validated virtual appliances: OPNsense for routing, firewalling, UTM and IPsec VPN, HAProxy for load balancing, NetBird for SD-WAN and road-warrior VPN, and Netmaker for zero-trust networking. XaasIO packages, validates, supports and can operate all of it under one release cycle, with one tenant model, identity and audit trail.
Is this a replacement for VMware NSX?
For the capabilities most estates use, yes: overlay segments, a distributed switch, security groups for micro-segmentation, tenant edge routing, NAT and firewalling, IPsec VPN and load balancing all have a function here. It is not a feature-for-feature NSX replacement. Items that depend on the design, such as Layer 2 extension across data centers, the Layer 2 gateway to physical networks and federation across sites, are settled in the assessment, and DPU-based acceleration is not offered. The NSX Exit Pack inventories what you use and maps it function by function, with partial items marked.
What does Open vSwitch do in XaasIO NFV?
Open vSwitch is the distributed virtual switch on every host. It encapsulates tenant traffic in VXLAN (Geneve and GRE are available) so that networks span hosts and follow virtual machines when they migrate, enforces security groups per port, trunks 802.1Q VLANs, bonds NICs with LACP, applies QoS and policing, mirrors ports through SPAN, RSPAN and GRE, exports NetFlow, sFlow and IPFIX, and is programmed through OpenFlow and OVSDB. It plays the role that VMware vNetwork Distributed Switch and Cisco Nexus 1000V play in vSphere.
Why OPNsense for the firewall, UTM and VPN?
OPNsense is a mature open-source firewall platform with a stateful inspection firewall, inline intrusion detection and prevention based on Suricata with Emerging Threats rule categories, web application control and caching proxy, captive portal, traffic shaper, IPsec and OpenVPN site-to-site and road-warrior VPN, high availability with configuration and state synchronization, built-in reporting with NetFlow and packet capture, and an API for every setting. It gives each tenant an edge that an operations team can reason about, with a plugin ecosystem and a predictable release cadence that XaasIO pins per release.
Why HAProxy for load balancing?
HAProxy is the reference open-source load balancer: Layer 4 and Layer 7, TLS termination, HTTP/2, health checks, ACL-based routing, session persistence through stick tables, rate limiting, zero-downtime reloads, a runtime API and Prometheus metrics. XaasIO delivers it as active-standby pairs behind a floating VIP, as the load balancer service for XaasIO Compute tenants and as the ingress controller for XaasIO Kubernetes.
What is the difference between NetBird and Netmaker, and why both?
Both build encrypted networks on WireGuard with a self-hosted control plane, and they are used for different jobs. NetBird is the SD-WAN and road-warrior VPN function: it connects sites, clouds, devices and remote users in a peer-to-peer mesh with network routes published by routing peers, relay fallback, single sign-on and access control policies, so data centers, branches and cloud VPCs reach each other without a hub appliance and users join from laptops and phones with the NetBird client instead of a VPN concentrator. Netmaker is the zero-trust function: WireGuard virtual networks with multi-network segmentation, remote access and egress gateways, relays, access control lists and conditional access, so users and services reach only what policy allows. Some estates need one, many need both; the assessment decides.
Does XaasIO NFV work with XaasIO Compute, Virtualization, HCI and Kubernetes?
Yes. On XaasIO Compute it is the networking behind OpenStack Neutron: tenant networks on the Open vSwitch or OVN driver, OPNsense as the router and firewall option, HAProxy behind the load balancer service and floating IPs from the provider edge. On XaasIO Virtualization and HCI it provides the Open vSwitch bridges, VLAN and VXLAN networks, cluster edges and application load balancers. For XaasIO Kubernetes it provides HAProxy ingress and LoadBalancer services and NetBird or Netmaker for cluster and operator access.
Is the firewall in the path of every packet?
No. East-west traffic between workloads stays on the Open vSwitch overlay, where security groups enforce micro-segmentation per port. OPNsense sits only where a boundary is crossed: to the internet, between zones that policy says must be inspected, or to another site. HAProxy sits only in front of the applications it balances. That is what keeps the overlay fast and the appliances small.
How is high availability handled?
The overlay has no single point of failure: Open vSwitch runs on every host and the control plane is deployed in high availability. OPNsense runs as CARP pairs with configuration and state-table synchronization and moving virtual IPs. HAProxy runs as active-standby pairs behind a floating VIP with zero-downtime reloads. NetBird uses redundant routing peers and relay fallback; Netmaker uses multiple gateways and relays. Appliance pairs are placed on different hosts with anti-affinity rules.
What about performance: DPDK and SR-IOV?
The default Open vSwitch kernel datapath suits most estates. For throughput-sensitive tenants, the Performance Pack enables the DPDK user-space datapath, SR-IOV for selected workloads, NIC bonding and NUMA-aware placement of appliances, and documents the measured results for your hardware. No throughput or latency figures are promised on this page; they come from the assessment and the acceptance tests.
How does multi-tenancy work?
Each tenant gets its own overlay segments with VXLAN identifiers, security groups, address space, edge and load balancer pairs or a share of a provider edge with virtual contexts, and its own SD-WAN and zero-trust policies, all tied to the tenant identity in XaasIO IAM. Service providers meter and bill tenant network services through the XaasIO Hyperscaler Platform.
Can XaasIO NFV run in an air-gapped environment?
Yes. Open vSwitch, the control plane and all four appliance types run inside the boundary. NetBird and Netmaker control planes are self-hosted, so no public coordination service is involved. Rule set and package updates, including IDS and IPS rules, arrive as signed offline bundles on the XaasIO release cycle.
How is the network observed?
Open vSwitch exports NetFlow, sFlow and IPFIX from every host; OPNsense sends NetFlow, firewall logs and Suricata events; HAProxy exposes statistics and Prometheus metrics; NetBird and Netmaker log connections and policy decisions. XaasIO MLT collects all of it into per-tenant dashboards and alerts, with packet capture on demand through port mirroring.
Are the components open source, and what are the licenses?
Open vSwitch is Apache 2.0, OPNsense is BSD 2-clause, HAProxy is GPLv2 with LGPL libraries, WireGuard is GPLv2 in the Linux kernel, and NetBird is BSD 3-clause. Netmaker publishes its server under the Server Side Public License with the client under Apache 2.0, and offers an enterprise edition for features such as failover and user management. XaasIO lists the exact versions and licenses of every component in the release SBOM, and no proprietary license key is needed to run the platform.
Are other XaasIO platforms required?
XaasIO NFV needs a XaasIO host platform to run on: Compute, Virtualization or HCI, or a mix of them. XaasIO MLT is optional and recommended for observability. XaasIO CMP and the XaasIO Hyperscaler Platform are optional and add the governed catalog, Day-2 automation, metering and billing.
How does a migration from NSX, hardware firewalls or load balancers work?
The NSX Exit Pack, the Firewall Policy Migration Pack and the Load Balancer Migration Pack follow the same method as the XaasIO VMware migration: inventory of segments, rules, virtual servers and VPNs; mapping to the overlay and the functions with partial items marked; translation and testing of rule sets and configurations on OPNsense and HAProxy in a pilot; then cutover in waves with the source kept until acceptance.
Who operates XaasIO NFV?
You choose: customer-operated with XaasIO support, co-managed, fully managed by XaasIO, or a dedicated XaasIO SRE Pod with 16×5 or 24×7 coverage. Every deployment includes a validated architecture, documented release and upgrade policy and an SBOM for every release.
VMware, vSphere, vCenter, Microsoft, Hyper-V, Azure, Red Hat, OpenShift, Ansible, Amazon Web Services, AWS, Google Cloud, Oracle, IBM, Nutanix, Proxmox, Kubernetes, Redfish, BMC, Helix, ServiceNow, GLPI, Zammad, HPE, Morpheus, FinOps Foundation, FOCUS and other product names are trademarks of their respective owners and are named for identification and comparison only. XaasIO is not affiliated with, endorsed by or sponsored by these organizations.
Build what the world depends on.
Planning a cloud for government, financial services, pharmaceuticals, healthcare, energy, transport, industry, service-provider operations, or private AI? Work with XaasIO to define the architecture, security boundary, and operating model your environment requires.