Skip to main content
Stateful Firewall & DPI

A Rules Engine That Tracks Every Connection

Firecradle checks every packet and tracks every connection's state. Rules run in priority order, matched by direction, protocol, address, and port. Deep packet inspection adds another layer on top.

IT Director / CIO
  • Zone-based rules with clear allow, block, or reject outcomes
  • Logging per rule for audit and compliance proof
  • No specialist needed to add or reorder a rule
  • Connection tracking shows live sessions in real time
Network / Security Admin
  • Match by direction, protocol, address, and port range
  • First-match order, with drag-and-drop reordering
  • Deep packet inspection goes beyond just header checks
  • See each session's connection state (new, established, related, or invalid)
System Administrator
  • Turn a rule off without deleting it
  • Choose reject or block per rule for different results
  • Back up your config and roll back before risky changes
  • Manage rules for every appliance from the cloud dashboard

Anatomy of a Firewall Rule

Every rule is built from the same eight fields. Combine them to make anything from a single-port allow rule to a broad zone-wide policy.

Direction
Choose inbound, outbound, or both. This controls which way traffic can flow through each interface.
Protocol
Match TCP, UDP, ICMP, or all of them. You pick the exact type of traffic to allow or block.
Source & Destination
Set any address, one network, one device, or a named group. This works on both sides of the rule.
Port Ranges
Pick a single port or a range, like 8000-8100. One rule can then cover a whole group of ports.
Action
Allow, block, or reject traffic. Reject sends a clear refusal back. Block just drops it silently.
Priority & Ordering
Rules run in order, and the first match wins. Drag and drop to reorder them. No config files to edit.
Per-Rule Logging
Turn logging on or off for each rule. Keep busy allow rules quiet so you can still see what matters.
Enable / Disable
Turn a rule off without deleting it. Handy for maintenance windows or gradual rollouts.
Example Rule
Priority 100Direction: inboundProtocol: tcpSource: 192.168.1.0/24Destination: anyPort: 22Action: allowLogging: on
"Allow SSH from the admin subnet" - this rule is matched and logged before any lower-priority catch-all rule runs.
Connection Tracking

Stateful Means the Firewall Remembers

A simple packet filter checks every packet against the full rule list, every time. Firecradle remembers the state of each connection instead. Return traffic for a connection you already allowed skips the rule check. It gets matched right away, safely. Anything outside a known connection is marked invalid and dropped.

NEW
The first packet of a connection. The firewall checks it against the rules to decide if the whole connection is allowed.
ESTABLISHED
A connection that already shook hands and has sent traffic both ways. It gets matched fast, with no rule re-check needed.
RELATED
A new connection tied to one already running. One example is an FTP data link opened by an active FTP session.
INVALID
Packets that do not fit any known connection. This includes broken, out-of-order, or faked traffic. Dropped by default.
Live Connection Detail
Protocol
tcp
Source
192.168.1.100:54321
Destination
8.8.8.8:443
State
ESTABLISHED
Packets in / out
1,500 / 2,000
Bytes in / out
128 KB / 256 KB
Deep Packet Inspection

Beyond IP Addresses and Port Numbers

Basic filtering just trusts that traffic on port 443 really is HTTPS. Firecradle looks deeper. It checks packet contents against the connection state. This catches traffic that does not match its stated protocol, or that carries a known bad pattern. Those checks feed straight into rule-based threat detection.

  • Checks the protocol and flags traffic that does not match its stated port
  • Runs alongside connection tracking, not as a separate extra pass
  • Feeds signature-based threat detection and blocking
  • No hidden AI model - every match traces back to a rule or a signature
Packet Evaluation Path
Packet Arrives on the Interface
Connection Tracker Checks the State
Deep Inspection Checks the Contents
Rules Run in Priority Order
Action Applied: Allow, Block, or Reject
Logged if the Rule Has Logging On

Real-World Use Cases

Exposing an Internal Web App Safely

Challenge: A small business wants to put an internal web app online, but not open its whole network.

How it's handled:
✅Inbound rule allows only TCP port 443, aimed at the web server
✅This rule sits above the catch-all rule that blocks everything else
✅Logging is on, so every connection attempt gets tracked
✅Every other device on that host stays hidden from the internet

Standardizing Policy Across MSP Client Sites

Challenge: An MSP runs a dozen client firewalls. It needs the same base rules, plus tweaks per site.

How it's handled:
✅One base set of rules gets pushed to every appliance from the cloud dashboard
✅Connection tracking lets each site admin see active sessions in real time
✅Logging from every rule feeds one shared audit trail across all client sites
✅Site-specific rules sit on top, without touching the shared base rules

Key Advantages

✅Full rule control: direction, protocol, address, port range, and priority
✅Stateful by design: return traffic is matched instantly, not re-checked
✅Deep inspection included: packet contents get checked, not just headers
✅Reject or block per rule: pick the response that fits the situation
✅Easy to audit: logging per rule, plus config backup and rollback

A Firewall That Knows the State of Every Connection

A stateful rules engine, connection tracking, and deep packet inspection, included in every Firecradle appliance.

No credit card required · Cancel anytime · 30-day free trial