Skip to main content
Complete feature list

Everything Firecradle does, on one page

One appliance, one price, no add-on licences. Here is the full list — 118 capabilities across 11 areas. The big ones have their own pages; the rest are here so you can check off exactly what you need.

118 features · all included
The Firecradle security dashboard, showing the protection score, active rules, tracked connections, blocked packets, and open alerts
Every feature below is real and shipping — this is the actual product.

Firewall & traffic controlfull page →

The core guard. Every packet is checked, and nothing gets in unless you allow it.

Stateful firewall→
Tracks every connection and lets replies back in, while blocking strangers.
Deep packet inspection→
Looks inside the traffic for known attacks, not just at the address on the outside.
Firewall rules→
Allow or block traffic by address, port, and time, on a guided form.
Address sharing & port forwarding→
Share one public address, and open one specific door to one inside device.
Aliases→
Name a group of addresses or ports once, then reuse it across many rules.
Rule groups & schedules→
Organize rules, and turn sets of them on or off by time of day.
Live connections view→
See every conversation the firewall is watching right now, and end any of them.
Threat alerts→
A ranked list of what was blocked and why, with one-click acknowledge.
Egress filtering wizard→
Move outbound traffic from wide-open to default-deny safely, after watching what is normal.
Auto rule suggestions→
Firecradle proposes rules from the traffic it sees, so you approve instead of compose.
Visual firewall map→
A plain picture of what is allowed in, what is forwarded, and what is blocking you.

Networks & routingfull page →

Split, connect, and route your network the way it actually needs to work.

Interfaces
Set up each network port, with live stats for every one.
Separate network segments→
Split one physical network into several separate ones that never see each other.
Link bonding→
Join several cables into one bigger, more reliable connection.
Interface groups
Target firewall rules at a whole set of interfaces by name.
Shared failover addresses→
Share one address between paired devices so failover is invisible.
Device allow-list→
Only devices you approve can join a segment. Unknown gear is turned away.
Smart-device isolation→
One click quarantines smart devices so a hacked camera cannot reach your laptop.
Guest network (one click)→
Sets up an isolated guest VLAN, a sign-in page, and a bandwidth cap in a single step.
Static routes→
Send certain traffic down a path you choose.
Gateways with monitoring→
Watches each internet line for lag and loss, not just whether it is plugged in.
Multiple internet lines→
Use more than one internet line, with automatic failover and load balancing.
Policy routing→
Send some traffic out one line and other traffic out another.
Routes that update themselves→
Routers tell each other about paths, so routes update themselves.
Site-to-site network bridges→
Bridge two sites into one network across the internet.
App-aware internet routing→
Sends each app over the best internet line for it, on its own.
Full IPv6 addressing→
Full IPv6, firewalled with the same default-deny rules as IPv4.
Transparent / bridge mode
Drop the firewall inline without changing your existing addresses.
Visual routing map→
A picture of how traffic flows and which line it takes.

Network servicesfull page →

The plumbing every network needs — name lookups, addresses, time, and guest access — built in.

Automatic address assignment→
Hands out addresses automatically, and pins the ones that must stay fixed.
Private name lookups→
Looks up names itself, so your browsing history stays on your own box.
Forwarded name lookups→
Passes lookups to servers you choose, when your company requires it.
Ad & malware blocklists→
Bad domains never resolve, for every device at once. No app to install.
Domain blocking & redirect→
Paste a list of domains and block them or send them elsewhere.
Names for your own machines→
Give your own machines real names, like printer.office.
Encrypted name lookups→
Nobody between you and the internet can read the sites you look up.
Name-lookup reports→
See which device looked up which site, and what got blocked.
Fixed name for a changing address→
A changing home or branch address keeps a fixed name.
Accurate time for your network→
Keeps accurate time and serves it to your network, so logs line up.
Wake a sleeping computer→
Turn a sleeping computer back on from the dashboard, by name.
Captive portal→
A proper sign-in page for guest Wi-Fi, with codes or paid access.
Automatic port opening for apps→
Lets trusted apps open the ports they need, off by default and fully logged.
Printer & cast sharing across networks→
Printers and casting show up across your separate networks.

Private tunnels & remote accessfull page →

Six ways to connect staff and sites safely, with no per-tunnel fee.

WireGuard→
Modern, fast VPN with a QR code or file for each device.
IPsec→
The long-established standard that works with almost any other vendor.
OpenVPN→
Works almost anywhere, even on restrictive networks.
L2TP/IPsec→
Uses the VPN client already built into every phone and computer.
Firecradle VPN (zero-cert)→
Staff sign in with their normal login. No certificates to hand out.
Tinc mesh→
Links many sites directly and heals itself if a link drops.

Security servicesfull page →

The protection layer beyond basic rules — all rule- and signature-based, never AI guesswork.

Attack detection & blocking→
Spots and blocks known attacks in real time, using published rule sets.
Auto-ban repeat attackers→
Bans sources that hammer your logins.
Known-bad address lists→
Known-bad address lists that update themselves.
Country blocking→
Block traffic from countries you never do business with.
Traps for attackers→
A fake target that catches attackers early.
Hidden admin access→
Keeps the management door invisible until you knock in the right pattern.
Impersonation detection→
Warns you when a device tries to impersonate the network.
Unusual-traffic alerts→
Learns what is normal and flags unusual outbound traffic in plain English.
Scans its own weak spots→
Firecradle scans its own attack surface on a schedule and tells you what is exposed.
Plain-language protection score→
One plain-language grade for how protected you are, with the top fixes.
Compliance check reports→
PCI, HIPAA, and CIS-style checklists with an exportable report.
Second login step→
A second login step for VPN and the guest portal.

Traffic shapingfull page →

Keep calls and video smooth when the line is busy.

Bandwidth caps→
Simple per-device or per-group bandwidth caps.
Smart traffic queues→
Smart queueing that stops one download from ruining a call.
Priority rules→
Sort traffic by app or address and give it priority.
Bandwidth quotas→
Per-device data caps that slow, rather than cut, once reached.
One-click presets→
Ready-made VoIP, gaming, and video-call profiles.

Web proxies & filteringfull page →

A middleman in front of your servers, and one in front of your users.

Server front-end & load sharing→
Serve several internal sites from one address, with HTTPS handled in one place.
Staff web filtering→
Filter and cache staff web access, default-deny.
Encrypted-web inspection→
Optionally look inside encrypted web traffic, with a guided certificate helper.

Failover & safe changesfull page →

You cannot break it for long, and it does not go down when hardware fails.

Two-box failover→
Two appliances, with automatic failover.
Live connections survive failover→
Live calls and transfers survive a failover, not just the address.
Anti-lockout→
A rule can never cut off your own access to the firewall.
Automatic save points→
Every change is saved on its own, with a 200-deep history.
One-click undo→
Undo any change, with a plain-language diff of what moved.
Restore points→
Named checkpoints you set before doing something risky.
Change history→
A git-like timeline of every change to the whole configuration.
Settings as text files→
Export the whole setup to a file you can keep in version control.
Recovery over a direct cable→
Fix an address, reset the password, or restore a safe firewall with no network.
Rescue mode→
A lifeline that works even when the web interface is unreachable.

Monitoring & diagnosticsfull page →

See what your network is doing, and prove it to whoever asks.

Dashboards→
System, services, interfaces, and gateways at a glance.
History graphs→
History you can zoom into for every metric.
Top talkers→
Who is using the bandwidth right now.
Connection map→
A world map of live connections.
Per-line quality history→
Latency, jitter, and loss history for each internet line.
Traffic summary export→
A summary of who talked to whom, sent to your reporting tool.
Read-only monitoring feed→
Firecradle shows up on the monitoring dashboard you already run.
Send logs to a central server→
Send logs to a SIEM, Graylog, or Loki.
Raw traffic capture→
Record raw traffic to a file when a problem makes no sense.
Scheduled email reports→
Emailed to you on a schedule, no login needed.
Diagnostics→
Ping, traceroute, DNS lookup, routes, and sockets, built in.
Troubleshooting guide→
When something breaks, it points you to the likely cause and the fix.

Platform & operations

The quiet plumbing that keeps the box healthy, current, and easy to run.

Guided setup wizard→
Answer a few questions and Firecradle configures itself for Home, SMB, MSP, or Enterprise.
Novice-to-expert interface→
The interface grows with you; expert power is never behind a higher price.
Automatic web certificates
Gets and renews the admin certificate on its own, with expiry warnings.
Your own certificate authority
Your own certificate authority: sign, import, and revoke certificates.
Safe automatic updates
Staged updates that health-check themselves and roll back if something breaks.
Add-on software
Install and update extra software from the web interface.
Hardware drivers
Add hardware drivers without the command line.
Advanced low-level tuning
Fine-tune low-level kernel settings when you need to.
Maintenance windows
Schedule quiet periods for changes and updates.
Automation rules→
Event-driven rules that act when something happens, with SSRF protection.
Chat alerts (Slack, Teams)→
Send alerts to Slack, Teams, Telegram, or Matrix.
Phone app with alerts→
A phone app with push alerts, so you hear about problems away from your desk.
Alert routing→
Send each kind of event to email, chat, or a webhook.
Battery-backup monitoring
Watches a battery backup and shuts down safely on a long outage.
Optional in-app assistant
An optional, opt-in in-app assistant that explains settings and helps you get unstuck.
Users, groups & roles→
Give each person only the access their job needs.
Sign in with company accounts→
Sign in with your existing company accounts.
Access tokens for scripts→
Scoped tokens for scripts and integrations.
Command-line tool→
A full command-line client, plus a live terminal view.
Full automation interface→
About 741 endpoints for building your own automation.
Multiple languages
The interface speaks more than one language.

Multi-site & managed providersfull page →

Run every customer firewall from one console, without opening a hole in anyone.

Fleet agent (outbound-only)→
The appliance calls home over an encrypted link. No inbound hole is ever opened.
Safe-command allow-list→
The console can only run a short list of safe operations.
Remote changes off by default→
Even the MSP console cannot silently rewrite a customer firewall until you allow it.
One console, every site→
Health, alerts, and versions for every appliance in one place.
Per-customer separation→
Each customer stays cleanly separate.
Standard setups across customers→
Apply a known-good setup to a new site with config-as-code.

Included, not upsold

Every feature on this page ships in every Firecradle appliance. Try it free for 30 days.

No credit card required · Cancel anytime · 30-day free trial