Firewall Engineered at the Packet Level
Firecradle operates where most consumer routers don't - every packet is matched against conntrack state, evaluated through a single unified nftables ruleset, and optionally handed to an inline Suricata engine for signature inspection, all before it's allowed to leave the box. A manifest-diff reconciler for routing and an atomic, single-transaction apply for the firewall table mean a config change is either fully applied or not applied at all - never half of both.
Every Component Stands Alone
The firewall/NAT engine, the routing layer, and the VPN stack are fully independent subsystems, each rendering its own config and reconciling its own state. Deploy what your environment needs - skip what it doesn't. No monolithic dependencies, no forced lock-in.
Firewall & NAT Engine
The nftables rule compiler and NAT compiler produce independent output, merged by a shared reconciler into one ruleset and applied as a single atomic transaction. Runs without touching routing, VPN, or shaping state.
Routing & Multi-WAN
Static routes, policy-based routing, gateway groups, and optional FRR dynamic routing (BGP/OSPF/RIP) reconcile against a persisted manifest - never touching a route it doesn't own, never flushing the system's main table.
VPN & Tunnel Layer
WireGuard, IPsec, and OpenVPN each manage their own keys, proposals, and processes independently. Every tunnel inserts only a tagged firewall rule to permit its listen port - it never edits the ruleset directly.
Stateful nftables rules - zone, protocol, port, schedule. Single ruleset, atomic apply.
Policy-based routing, multi-WAN gateway groups, optional BGP/OSPF/RIP via FRR.
tc/HTB/HFSC/cake queue trees. DSCP + priority marking, VoIP/gaming presets.
WireGuard, IPsec, or OpenVPN - each independent, each auto-permitted by the firewall.
Combine two appliances as an active/passive VRRP pair. The standby mirrors config via a scoped REST sync and keeps session state current via conntrackd - so a failover doesn't just move an IP, it keeps existing connections alive.
Firecradle targets 100k+ packets-per-second rule evaluation with sub-10ms latency, and inline IPS scanning happens on the same box, in the same pass, before the packet leaves. There's no redirecting traffic through a third-party scrubbing center to get an inspection verdict.
The 8-Phase Packet Pipeline
Every packet - inbound, outbound, or forwarded - passes through a deterministic eight-phase pipeline, with destination NAT applied before routing and source NAT applied after filtering. No shortcuts, no silent drops.
INGRESS
Every packet lands on a physical or bonded NIC and enters the kernel netfilter prerouting hook before any routing decision is made - the earliest point in the stack where Firecradle can see the traffic at all.
CONNTRACK
The connection-tracking subsystem hashes the packet's 5-tuple and checks it against the kernel conntrack table. A hit classifies it ESTABLISHED or RELATED; a miss marks it NEW; malformed packets are flagged INVALID.
DESTINATION NAT
Still in the prerouting hook, DNAT rewrites the destination address for port-forwards and 1:1 mappings - before the routing decision, so a port-forwarded packet is routed and filtered against its rewritten (internal) destination, not the one it arrived with.
ROUTE
A routing decision selects the egress path based on the post-DNAT destination - the system routing table, a policy route chosen by source/destination/mark via ip rule, or a multi-WAN gateway group balancing or failing over across links.
FILTER
The packet is evaluated against the single unified nftables table (table inet firecradle) - input, forward, or output chain, matched on zone, protocol, port, and conntrack state in one pass.
INSPECT
Rules that call for deep inspection hand the packet to Suricata over an NFQUEUE verdict channel. Its signature engine checks payload against ET Open, ET Pro, VRT, or custom rule sets and returns a verdict.
SOURCE NAT
In the postrouting hook, after filtering has accepted the packet, SNAT/masquerade rewrites the source address for outbound traffic - compiled into the same ruleset as the filter rules, applied atomically.
EGRESS
The packet reaches postrouting and, if a shaper rule matches, is classified into a queue - DSCP-marked, priority-tagged, and scheduled through HTB, HFSC, or cake - before it leaves the interface.
netfilter/nftables - One Unified Ruleset
Firecradle runs nftables only - no iptables. Filter and NAT rules both live in a single named table, table inet firecradle, so the same ruleset can be reasoned about, tested, and applied as one object instead of two.
A rule engine compiler and a NAT compiler produce their output independently, but a shared reconciler merges both into one ruleset before every apply - avoiding a class of bug where the NAT compiler's own flush could clobber rules the filter compiler had just written.
| State | How It Works | Priority | Rule Cost |
|---|---|---|---|
| ESTABLISHED | Packet matches an existing tracked flow. Fast-paths through the ruleset without a full rule scan | Fastest | Fast-path match |
| RELATED | Belongs to a helper-tracked secondary flow of an existing connection (e.g. an FTP data channel, an ICMP error) | Fast | Helper-assisted match |
| NEW | First packet of a flow with no conntrack entry yet - evaluated against the full ruleset, including any DPI hand-off | Standard | Full rule evaluation |
| INVALID | Doesn't fit any known connection - out-of-window TCP, malformed headers, or spoofed traffic | Reject | Dropped immediately |
The rule engine and the NAT engine compile independently, but a shared reconciler merges both outputs before every apply, so a single nft -f - transaction writes one table inet firecradle with every filter and NAT chain together - never two separate flushes racing each other.
Never Flush What You Don't Own
Firecradle re-renders the full desired routing state on every change and applies it as a single, idempotent pass. No incremental patch queue, no partial state to reconcile by hand - and no risk of wiping a route it doesn't own.
The routing module keeps a manifest of every route it manages. On each apply, it diffs the desired state against that manifest and issues ip route replace for changes and ip route del only for routes it owns by key. It never runs a full table flush against main - that table also holds routes owned by DHCP and the OS.
- Desired state loaded from config, keyed by address family + table + destination
- Manifest at /etc/firecradle/routes.json tracks every previously-applied, Firecradle-owned key
- Idempotent ip route replace re-converges without unnecessary route flaps
- Default-route ownership assigned to a single module, preventing two subsystems from racing to program 0.0.0.0/0
- The same manifest-diff pattern protects VLANs and bonds - reapplying a config is a no-op update, not a rebuild
Beyond Packet Filtering - The Appliance Actively Defends
A cloud-redirected UTM stops at forwarding your traffic somewhere else for inspection. The Firecradle appliance is a full compute node that scans, monitors, and fails over on its own. It runs inline signature inspection in the same pass as the rest of the ruleset. It watches every WAN link's health continuously. It keeps sessions alive through a node failure - not a guess about uptime.
Inline IPS/IDS Threat Scanning
Rules that call for inspection hand the packet to Suricata over an NFQUEUE verdict channel before it ever reaches its destination - signature matches against ET Open, ET Pro, VRT, or custom rule sources, all on the same box.
Config Validated Before It Applies
Every ruleset change is syntax-checked (nft -T) and every IDS/IPS config is validated (suricata -T) before it ever touches a live interface. A bad change is rejected outright - it never becomes a bad reload.
Gateway Health Monitoring & Failover
Each WAN gateway is probed continuously (ping/fping, ~5s interval), tracking loss percentage and RTT. Warn/alert thresholds default to 20%/40% loss and 300ms/500ms latency, driving automatic failover before users notice.
Line-Rate Local Rule Evaluation
Rule matching happens on-box, targeting 100k+ packets-per-second with sub-10ms evaluation latency - no redirecting traffic through a third-party scrubbing center to get an enforcement decision.
On-Box Enforcement, No Cloud Dependency
The ruleset, IPS engine, and VPN termination all run locally. Losing internet connectivity doesn't disable protection - it just removes remote management until the link returns.
Safe Reconciliation, Never Clobbers System State
The routing manifest-diff only deletes routes it manages by key - DHCP and OS-installed routes are untouched. The firewall table applies as one atomic transaction - always fully old or fully new, never a partial ruleset.
| Capability | Firecradle Appliance | Cloud-Redirected UTM |
|---|---|---|
| Inline IPS/IDS scanning | ✓ Suricata engine runs on-box | ~ Traffic redirected to a scrubbing center |
| Config apply safety | ✓ Validate-then-atomic-apply (nft -T) | - Vendor-managed, no local dry-run |
| Gateway/multi-WAN failover | ✓ Local active probes (20%/40% loss) | ~ DNS-based failover - minutes, not seconds |
| VPN tunnel termination | ✓ WireGuard/IPsec/OpenVPN, terminated local | - Traffic hairpins through a vendor PoP |
| Air-gap / offline enforcement | ✓ Zero internet required for enforcement | ✗ Requires continuous cloud connectivity |
| HA failover with session continuity | ✓ VRRP + conntrackd - sessions survive | ~ Vendor-managed, opaque failover behavior |
| Traffic shaping enforcement | ✓ On-box tc/HTB/HFSC/cake queue trees | - Best-effort, no local queue control |
| Route/rule change safety | ✓ Manifest-diff - never touches unmanaged state | - Opaque, vendor-controlled apply |
Atomic Ruleset Apply - No Partial State
When Firecradle pushes a firewall or routing change, it doesn't patch the running configuration rule-by-rule. It renders the complete desired ruleset - filter and NAT chains merged by the reconciler - and applies it as one transaction. The kernel accepts the entire new table or keeps the old one; there is no window where half the rules are old and half are new.
The same discipline applies to routing: the reconciler diffs desired routes against a persisted manifest and only touches the keys it manages. An anti-lockout rule is prepended ahead of the default-drop policy on every apply, so management access survives even a broken ruleset push.
O(1) Flow Lookup - Regardless of Table Size
Every active connection is tracked in the kernel's conntrack table, keyed by a hash of its 5-tuple - protocol, source/destination address, source/destination port. Tested at 10,000+ concurrent connections, a lookup to determine whether a packet belongs to an existing flow is a constant-time hash operation regardless of how many connections are active.
Conntrack isn't a Firecradle-proprietary store - it's exposed and manageable through the standard Linux conntrack tool, so anything the ruleset does with connection state is independently verifiable from the command line.
Single-Pass DPI - No Second Scan
Deep packet inspection happens inline, in the same pass as the rest of the ruleset evaluation - not as a separate scan after the fact. When a rule calls for inspection, the packet is handed to Suricata and a verdict comes back before it's allowed to continue:
In steady state, most tracked flows sit in ESTABLISHED and skip full rule re-evaluation - only NEW flows and the rare INVALID packet pay the cost of a full ruleset pass.
Firecradle exposes this through the standard Linux conntrack tool - conntrack -L -o extended for a live dump, conntrack -S for aggregate stats, conntrack -D to terminate a specific flow by its 5-tuple.
VRRP Failover + Multi-WAN Resilience
Firecradle pairs run active/passive - not a complex multi-node consensus cluster. A virtual IP fails over via VRRP in one direction; multiple internet connections fail over, or load-balance, independently in the other.
A two-node CARP-style design, not an N-node Raft cluster - a simpler, more predictable failure mode for a firewall pair.
The primary pushes a config bundle to its peer over an authenticated REST call, scoped to selected categories (rules, NAT, aliases, certs, users). Interface and HA-identity settings are excluded, so a sync can't clobber peer-local identity.
Trigger a failover on demand for maintenance, or let VRRP's own advertisement timing handle it automatically.
conntrackd state sync means an in-progress connection doesn't need to restart from scratch after a failover.
Continuous ping/fping checks, not a passive link-up/link-down signal - a WAN can be up but still failing.
Separate warn and alert thresholds (20%/40% loss, 300ms/500ms latency) avoid flapping on a single bad ping.
A multi-tier gateway group fails over; a single-tier weighted group load-balances across WANs simultaneously via multipath routing.
The reconciler only deletes routes it manages by key from its manifest - it never flushes the main table that also holds DHCP and OS-installed routes.
Hierarchical QoS - tc, HTB, HFSC, and cake
Firecradle's shaping engine is built entirely on Linux tc - never nftables - so it can never collide with the firewall table's flush-and-rebuild apply. Three building blocks compose every policy: Limiters (bandwidth pipes using HTB, TBF, or cake), Queues (hierarchical scheduler trees using HFSC, HTB, or strict-priority PRIQ), and Shaper Rules (classification and marking via flower/u32 filters). HFSC's service curves model three guarantees per queue - realtime, linkshare, and upperlimit - so latency-sensitive traffic gets a floor without starving everything else.
Tunnel Establishment - WireGuard, IPsec, OpenVPN
Whichever tunnel technology a policy uses, Firecradle never hand-rolls the crypto or the interface plumbing - it drives the same production-grade tools those protocols were built around, and never touches the firewall table directly.
Five Tunnel Types - One VPN Engine
The same firewall auto-rule integration backs every tunnel technology. Add the Hybrid Failover pattern when a single link isn't enough.
- wg-quick manages persistent config; wg syncconf hot-reloads peers without dropping the interface
- Fixed ChaCha20Poly1305 AEAD cipher suite - no negotiation, no downgrade risk
- Client export as a .conf file or a scannable QR code (qrencode)
- Road-warrior and site-to-site peers coexist on the same interface
- PSK, RSA, ECDSA, and EAP authentication methods
- Default proposals: aes256-sha256-modp2048 (IKE) / aes256-sha256 (ESP)
- Dead Peer Detection with a configurable restart action (30s default delay)
- MOBIKE support keeps a roaming road-warrior session alive across network changes
- AES-256-GCM (AEAD - integrity built into the cipher) by default; SHA-256 secures the TLS control channel / tls-crypt
- tls-crypt hardens the control channel against DoS and TLS fingerprinting
- Per-client static IPs via client-config-dir (CCD)
- Site-to-site mode reuses the identical server model
- A fixed Endpoint peer over WireGuard or IPsec for a permanent connection
- PersistentKeepalive traffic holds NAT bindings open on both sides
- The firewall auto-inserts a tagged permit rule for the tunnel's listen port
- Multiple peers provide redundant paths between sites
- Auto-generated client keypair with exported .conf and QR code (WireGuard)
- EAP/XAuth authentication for IPsec remote-access peers
- Inline .ovpn bundles - CA, cert, key, and tls-crypt in a single file (OpenVPN)
- Certificates issued from the local PKI or via ACME / Let's Encrypt
Defense in Depth - At Every Layer
IPsec Default Cipher Suite
IKE SA negotiated with aes256-sha256-modp2048, ESP data channel with aes256-sha256 - configurable per connection through strongSwan's swanctl, with ChaCha20 available as an alternate cipher.
WireGuard Fixed Cryptography
ChaCha20Poly1305 AEAD encryption with Curve25519 key exchange - the protocol ships one cipher suite by design, removing negotiation and downgrade attacks as a category entirely.
OpenVPN tls-crypt Hardening
The control channel is wrapped with tls-crypt by default, hiding TLS handshake metadata from network observers and hardening the listening port against DoS scanning.
Suricata Signature Engine
Inline (NFQUEUE) or detection-only (af-packet) inspection against ET Open, ET Pro, VRT, or custom rule sources. No black-box AI/ML - every match traces back to a signature ID.
Anti-Lockout Rule
A management-access allow rule is always prepended ahead of the default-drop policy, so a misconfigured ruleset push can't lock an administrator out of the appliance.
Validate-Then-Apply
Every config change is syntax-checked (nft -T, suricata -T) before it touches a live interface - a bad rule is rejected outright, never silently half-applied.
Every tunnel technology defaults to a 256-bit cipher. IPsec and OpenVPN proposals are configurable per policy; WireGuard's suite is fixed by protocol design - simplicity that also removes an entire class of downgrade attacks.
Stop Credential Attacks Before They Land
fail2ban watches authentication logs across every exposed service and bans offending sources into a dedicated nftables set - firecradle_banned - that the input chain drops against. It never creates a competing table, so it can't collide with the firewall module's atomic flush-and-rebuild apply.
Performance That Scales
One Firewall - Every Network Layer
- 802.1Q VLAN tagging with optional QinQ (802.1ad) double-tagging for provider trunks
- Link bonding modes: active-backup, balance-rr/xor, broadcast, with 802.3ad/LACP layered on top
- Per-VLAN interface isolation, verified by automated end-to-end tests
- miimon-based link monitoring drives bond failover detection
- Policy-based routing via ip rule - match by source, destination, fwmark, or inbound interface
- Multi-WAN gateway groups: failover, or ECMP weighted load-balancing
- Manifest-diff reconciliation - never flushes the system's main routing table
- Optional dynamic routing via FRR - BGP, OSPF, and RIP
- Single unified nftables table with stateful conntrack matching (ct state)
- Inline Suricata IPS via an NFQUEUE verdict handoff, or IDS-only detection over af-packet
- ET Open, ET Pro, VRT, or custom signature rule sources
- fail2ban brute-force jails layered onto the same input chain via an nftables set
Prometheus-Native Metrics Out of the Box
Firecradle exposes per-rule, per-connection, and per-queue telemetry out of the box - not just interface counters. Metrics are retained locally and exportable to any Prometheus-compatible stack.
Why This Engineering Translates to Real Business Value
Predictable Line-Rate Performance
Targeting 100k+ PPS with sub-10ms rule evaluation, the firewall keeps up with real traffic without becoming the bottleneck on the network.
Fewer Blind Spots
A single unified nftables table means filter and NAT are always evaluated as one consistent ruleset, not two systems that can silently drift out of sync.
Verified Config Changes
Every apply is validated - nft -T, suricata -T - before it touches production, so a bad rule change never becomes a bad reload.
Resilient by Design
VRRP + conntrackd active/passive HA keeps sessions alive through a node failure; multi-WAN failover keeps traffic flowing through an ISP outage.
Threat Detection You Can Audit
Suricata plus ET Open/ET Pro/VRT rules - transparent and tunable, with no black-box model deciding what gets blocked.
Safe by Default
An anti-lockout rule and manifest-diff reconciliation mean a config push can't lock you out or wipe a route it doesn't own.