[truffdog]

I used to work for a Guardicore competitor, my recollection is that Guardicore didn't use iptables, and instead had a custom kernel module.

Which is good in that you have more freedom to add features, and bad in that it's really easy to break stuff with a kernel module.