EU-sovereign · zero-trust network cloaking
Same app. Two servers. One is exposed to the internet, the other is cloaked by Veil. A port scan finds everything on the first — and nothing on the second. When there's nothing to reach, there's nothing to attack.
The setup
Both are Ubuntu boxes running the exact same production stack — an internal admin console, a self-hosted AI model, a cache, and a database. The only difference is how you reach them.
The scan · the whole story in one command
nmap -sV is the first thing every attacker runs. Here is its real output against each server, verbatim.
$ nmap -sV exposed.getveil.eu PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.6p1 Ubuntu 80/tcp open http ACME Ops internal console 5432/tcp open postgresql PostgreSQL 6379/tcp open redis Redis key-value store 7.0.15 11434/tcp open http Ollama API (self-hosted LLM) # scan completed in 11.45s — full attack surface
$ nmap -sV cloaked.getveil.eu PORT STATE SERVICE VERSION 22/tcp closed ssh 80/tcp closed http 5432/tcp closed postgresql 6379/tcp closed redis 11434/tcp closed http # scan completed in 0.62s — nothing to attack
No exploit needed — just connect
Nothing below uses a vulnerability, a zero-day, or a stolen password. It's just an attacker connecting to services that answer the whole internet — and then running the same commands against the cloaked box.
# ── Against exposed.getveil.eu ───────────────────────────── $ redis-cli -h exposed.getveil.eu KEYS '*' cust:2 cust:1 stripe:live_key session:9f3a2b $ redis-cli -h exposed.getveil.eu GET stripe:live_key "sk_live_51Nx0b2Qf" $ psql -h exposed.getveil.eu -U postgres -d acme -c 'select name,email from customers' Nadia Bakker | nadia@northwind.eu Sofie Jansen | sofie@deltlogix.nl $ curl exposed.getveil.eu:11434/api/version {"version":"0.32.1"} # ── Same commands against cloaked.getveil.eu ─────────────── $ redis-cli -h cloaked.getveil.eu KEYS '*' ^C (hangs / no response) $ psql -h cloaked.getveil.eu -U postgres ... psql: connection to server ... failed: Connection refused $ curl cloaked.getveil.eu:11434/api/version (no response)
Same console · two very different front doors
This is the internal operations console both servers run. On the left, anyone who scans the IP can load it. On the right, the only way in is a verified identity over the overlay.
| Host | Service | Status |
|---|---|---|
| acme-db-01 | PostgreSQL | ● healthy |
| acme-cache-01 | Redis | ● healthy |
| acme-k8s-cp | K8s control-plane | ● healthy |
| Host | Service | Status |
|---|---|---|
| acme-db-01 | PostgreSQL | ● healthy |
| acme-cache-01 | Redis | ● healthy |
| acme-k8s-cp | K8s control-plane | ● healthy |
Attack vectors removed
Every attack below has the same first requirement: the attacker has to be able to reach the service. Veil removes that first step — so none of the rest can start.
Mass scanners index every open port on the internet within hours. With Veil there is no reachable port to find or catalogue — you never make the list.
Open caches and databases hand over their contents to anyone who connects. With Veil the datastore simply isn't on the internet to connect to.
Exposed databases get wiped and held for ransom at scale. If there's nothing to reach, there's nothing to encrypt or extort.
Public model endpoints leak to model theft, free GPU abuse, and RCE on unpatched builds. Behind Veil, the API answers no one on the open internet.
Every public login page is a target for endless guessing. With Veil there is no login page facing the internet to hammer.
Edge services get hit by new CVEs before you can patch. Behind Veil the service is dark before auth even happens — the exploit can't reach it.
The common thread: every one of these needs reachability first. Veil removes reachability — so the attack never reaches step two. Access becomes identity-gated, MFA-protected, and fully audited instead of open to the internet.
Straight talk
The move is simple
Same apps, same team, same workflows — just unreachable to everyone who hasn't proven who they are.
# Reproduce every result on this page: nmap -sV exposed.getveil.eu # 5 open ports — full attack surface nmap -sV cloaked.getveil.eu # nothing to attack