An apparatus for hardware-based filtering in a multi-level secure cross-domain infrastructure includes a programmable logic device that includes a filter engine in communication with a first security module. An interface module of the filter engine is configured to receive a message from the first security module. The received message being sent to a second security module, which has a different security classification than the first security module. A filter module of the filter engine is configured to filter the message data according to a message rule, which defines a data compliance requirement associated with the security classification of the second security module. A routing module is configured to provide the message to the second security module in response to the message data complying with the message rule.