mTLS, SNI Protection, and OTP: The Anubis Security Stack

Most VPNs and remote access tools weren't built for the strict security needs of industrial environments. That's why I built Anubis: a Zero Trust Network Access solution that combines an overlay mesh with application-layer security. Here’s how the architecture works...

Here's the complete architecture of Anubis ZTNA:

1. Overlay Mesh Network (10.144.144.0/24)

Anubis leverages ZeroTier to create a private, secure overlay network where each node (like 10.144.144.7 for the Access Agent) connects seamlessly. This isolates sensitive traffic from the underlying physical network, making it invisible to external observers. ZeroTier provides the reliable mesh backbone, while Anubis adds the Zero Trust security layer on top.

2. Access Agent & Whitelist

The agent listening on 127.0.0.1 (localhost) acts as a gateway for local applications. The whitelist with SHA256 process verification ensures only authorized programs can establish connections, no unauthorized executables allowed.

3. mTLS and SNI Protection

All communications are secured with mTLS (Mutual TLS) using standard P12/PFX certificates. SNI protection (Server Name Indication) hides domains like vnc.server.local and rdp.server.local, making it impossible for external observers to identify which services you're using.

4. Access Ports & Services

Each service is exposed on dedicated ports (e.g., 34001 for RDP, 34002 for SSH, 8443 for HTTPS, 42444 for OPC UA). Connections arrive at 127.0.0.1:xxxx on the agent, creating an isolated tunnel for each protocol.

5. Security Layer (ACL, CRL, TOTP)

• ACL (Access Control List) with time constraints (start-end, days, expires, enabled/disable within 60 seconds) for temporary access

• CRL (Certificate Revocation List) for instantly revoking compromised certificates

• Token BOR (Burn On Read) the token is consumed on first use, preventing replay attacks

6. Anubis Core (Sidecar Mode)

The Anubis core runs in sidecar mode alongside your services on a dedicated server. It handles authentication, encryption, and traffic routing without interfering with your existing infrastructure.