Networking words, in plain English
Firewall documentation is full of short words that mean big things. Here is what each one means, without the jargon. Every term on this site links back here.
The basics
Firewall
A guard that sits between your network and the internet. It checks every piece of data going in or out and blocks anything you have not allowed.
NGFW
A firewall that does more than block ports. It also looks inside the traffic for attacks, runs VPNs, sorts traffic by priority, and reports what is happening on your network.
Appliance
A small computer built to do one job. A firewall appliance arrives with the software already installed, so you plug it in instead of building a server yourself.
Packet
A small chunk of data. Everything you send online is chopped into packets, sent separately, and put back together at the other end.
Port
A numbered door on a device. Web pages usually come in through door 443, email through door 25. Firewall rules mostly decide which doors are open.
Protocol
An agreed set of rules for how two computers talk. TCP and UDP are the two common ones for moving data.
LAN and WAN
LAN is your own network — the devices in your building. WAN is the connection out to the internet. A firewall sits between the two.
IP address
The number that identifies a device on a network, like a street address. 192.168.1.10 is a typical address inside a home or office.
Subnet
A block of IP addresses that belong together, like all the houses on one street. Devices in the same subnet can usually reach each other directly.
IoT device
A smart gadget that connects to the internet but is not a computer or phone. Cameras, doorbells, TVs, and thermostats are all IoT devices.
Security
Stateful firewall
A firewall that remembers conversations. When your laptop asks a website for a page, the firewall remembers and lets the reply back in — but it still blocks strangers who start a conversation from outside.
DPI
Looking inside the data, not just at the address on the outside. It is the difference between reading the envelope and reading the letter, and it is how known attacks get spotted.
IDS and IPS
IDS watches traffic and warns you when it spots a known attack. IPS does the same thing but also blocks the attack as it happens. Firecradle uses Suricata for both.
Signature
A description of a known attack, a bit like a fingerprint on file. Firecradle compares traffic against published signature lists rather than guessing with AI.
Connection tracking
The list of conversations your firewall is currently watching. Each entry records who is talking to whom, so replies get through and everything else does not.
GeoIP blocking
Blocking traffic based on the country it comes from. Useful when you know your business never has customers in a particular place.
Honeypot
A fake target left out on purpose. Nobody has a legitimate reason to touch it, so anything that does is almost certainly an attacker — and you find out early.
Port knocking
Keeping a door completely invisible until someone knocks in the right pattern. Scanners see nothing at all, so they have nothing to attack.
Anti-lockout
A safety net that stops a firewall rule from cutting off your own access to the firewall. Without it, one bad rule can mean a drive to the site.
2FA
Asking for a second proof of identity on top of a password, usually a six-digit code from a phone app. A stolen password on its own is then not enough.
Default deny
Blocking everything unless you have specifically allowed it. It is safer than the opposite, because anything you forgot about is blocked rather than open.
Threat-intelligence feed
A regularly updated list of internet addresses already known to be doing harm, shared by security groups like Spamhaus or DShield. Firecradle downloads these lists and blocks the addresses on them automatically.
Rogue DHCP detection
Watching for a second, unauthorized device on the network handing out addresses. A rogue DHCP server can quietly redirect traffic, so Firecradle flags one the moment it appears.
ARP spoofing
A trick where a device lies about which address it is, so it can intercept traffic meant for someone else. Firecradle watches for this lie and raises an alert.
PCI, HIPAA & CIS
Three common rulebooks businesses must follow: PCI for handling card payments, HIPAA for health records, and CIS for general good security hygiene. Firecradle checks your setup against each and gives you a report.
LDAP
A standard way for software to look up people and passwords stored in a company directory, instead of keeping a separate list of logins.
RADIUS
An older, widely supported standard for checking a username and password against a central server. Many company Wi-Fi and VPN systems already use it.
Active Directory
Microsoft’s directory of company user accounts and passwords. Most Windows-based offices already have one, so Firecradle can check logins against it instead of keeping a separate list.
TLS
The encryption behind HTTPS. It scrambles traffic between a browser and a website so nobody in between can read or change it.
TLS inspection
Opening encrypted web traffic to scan it, then re-encrypting it before it carries on. It needs a certificate installed on every device that is inspected, and it is optional.
Networks and routing
NAT
Letting many devices share one public internet address. Your firewall swaps the internal address for the public one on the way out and swaps it back on the way in.
PAT
The trick that makes NAT work for lots of devices at once. Each conversation gets its own port number so replies find their way back to the right device.
Port forwarding
Opening one specific door from the internet to one specific device inside — for example, sending web traffic to your web server and nothing else.
Network switch
The box with lots of cable ports that devices plug into. On its own it just passes traffic along. A switch that understands VLANs can also keep groups of devices apart.
VLAN
A way to split one physical network into several separate ones. Guest Wi-Fi, security cameras, and office computers can share the same cables but never see each other.
DHCP
The service that hands out IP addresses automatically. It is why a new laptop just works when you join the Wi-Fi instead of asking you to type in numbers.
DNS
The internet phone book. It turns a name you can remember, like firecradle.com, into the numeric address computers actually use.
DoH and DoT
Encrypted versions of DNS. Without them, anyone between you and the internet can read a list of every site you look up.
IPv6
The newer, much larger set of internet addresses. The world ran out of the old IPv4 ones, so most internet providers now hand out both.
SLAAC
A way for an IPv6 device to build its own address from the network it joins, with no server needed to hand one out.
DHCPv6
The IPv6 version of DHCP. It hands out IPv6 addresses and settings the same way regular DHCP does for IPv4.
Prefix delegation
Your internet provider hands your firewall a whole block of IPv6 addresses, which it then divides up and hands out to your own devices.
Router advertisement
A message a firewall sends out to tell devices on the network which IPv6 addresses to use and where the internet connection is.
Routing
Deciding which path data takes to reach its destination — the network equivalent of picking which road to drive down.
Multi-WAN
Using more than one internet connection at once. If one goes down, traffic moves to the other, and your business stays online.
Failover
Automatically switching to a backup when something breaks, without anyone having to notice or press a button.
SLA
A promise about how well a connection should perform, usually measured in delay, jitter, and how many packets get lost. Tracking it over time shows whether an internet line is actually keeping its promise.
Load balancing
Using two or more internet lines at the same time to share the work, instead of keeping one idle as a spare. It is different from failover, which keeps a line in reserve until it is needed.
Health check
A small, constant test a firewall runs on each internet line to see if it truly works, not just whether the cable is plugged in. A line can look connected but still fail a health check.
BGP and OSPF
Two ways for routers to tell each other about available paths, so routes update themselves instead of being typed in by hand. Larger networks rely on them.
SD-WAN
Picking the best internet line for each app in real time, instead of one fixed choice. A video call might go over the fast line while a backup upload goes over the slower one.
GRE and VXLAN
Two ways to join two networks over the internet so they behave like one shared wire. Unlike a VPN, the traffic inside is not encrypted, so this is usually paired with one.
FRR
Routing software that speaks BGP, OSPF and RIP, so a firewall can join a larger network and learn new paths automatically instead of someone typing them in by hand.
RIP
An older, simple way for routers to share the paths they know about. Still common on small or older networks.
Policy-based routing
Sending specific traffic down a specific line, based on more than just where it is going. For example, always sending card payments over the most reliable line.
ECMP
Spreading traffic across several equally good paths at the same time, so you use all your bandwidth instead of leaving a line idle.
Link bonding
Joining several network cables so they act as one bigger, more reliable connection. If one cable fails, the rest carry on.
Captive portal
The sign-in page that appears when you join Wi-Fi at a hotel or cafe. You can use it to show terms, hand out access codes, or sell access.
Proxy
A middleman for web traffic. A reverse proxy sits in front of your servers and shares traffic between them; a forward proxy sits in front of your users and filters what they can reach.
HTTP/2
A newer, faster version of the language web browsers and servers use to talk. It lets one connection carry many requests at once, instead of queuing them one by one.
VPNs and remote access
VPN
A private, encrypted tunnel across the public internet. Staff working from home use one to reach office systems safely.
WireGuard
A modern VPN that is fast and simple to set up. Its small size makes it easier to trust and easier to run on low-powered hardware.
IPsec
The long-established VPN standard. It is the safest choice when you need to connect to equipment from another vendor, because nearly everything supports it.
OpenVPN
A widely used VPN that works almost anywhere and copes well with restrictive networks, because it can look like ordinary web traffic.
Site-to-site VPN
A permanent tunnel joining two offices, so both behave like one network. Staff at either end reach shared systems without doing anything special.
Remote-access VPN
A tunnel for one person rather than a whole office — what an individual laptop or phone uses to connect back to work.
Mesh VPN
A VPN where every site connects to every other site directly, and traffic reroutes itself if a link drops, rather than everything passing through one head office.
Speed and traffic
QoS
Deciding which traffic matters most when the line is busy. It is what keeps a video call clear while a large download is running.
Traffic shaping
Controlling how much bandwidth different people or apps can use, so one big download cannot slow everyone else down.
Bufferbloat
The lag you feel when a connection is busy, caused by data piling up in queues. Modern queue methods like CAKE and FQ_CoDel are designed to fix it.
CAKE and FQ_CoDel
Two smart ways of managing traffic queues. They stop any single download from hogging the line, which keeps calls and games responsive.
Throughput
How much data a device can actually move per second. It is the real-world speed limit, and it drops if a device has to inspect traffic closely.
Running it day to day
HA
Running two devices as a pair so that if one fails, the other takes over straight away and people keep working.
VRRP
The agreement two paired devices use to share one address. Whichever device is healthy answers to it, so the switch-over is invisible to your computers.
State sync
Copying the list of live conversations to the backup device continuously. It is why a call or file transfer survives a failover instead of dropping.
MSP
A company that runs IT for other businesses. MSPs look after many customer networks at once, so managing them all from one screen matters a lot.
RBAC
Giving people only the access their job needs. A junior technician can look but not change; a senior engineer can do both.
API
A way for one piece of software to ask another piece of software to do something. Firecradle has one so scripts, tools, and its own command line can control it without clicking through screens.
Config as code
Keeping your settings in a text file you can store in version control, review, and reapply — instead of clicking through screens to rebuild a device.
CLI
A way to control Firecradle by typing commands instead of clicking. It is what scripts and config-as-code use to set things up automatically.
Config snapshot
An automatic save point taken every time you change a setting, so you can undo a mistake with one click rather than trying to remember what you changed.
NetFlow and IPFIX
A summary of who talked to whom and how much data moved, sent to a reporting tool. Much smaller than recording all the traffic itself.
SNMP
A long-standing way for monitoring tools to read a device’s health, so your firewall shows up on the same dashboard as everything else you run.
Syslog
The standard format for sending log messages to a central server, so records are kept somewhere safe even if a device is lost or wiped.
SIEM
A central tool that collects logs from every device on your network so a security team can search them and spot trouble in one place, instead of checking each device on its own.
Packet capture
Recording raw traffic to a file so you can examine exactly what happened. It is the last-resort tool when a problem makes no sense.
Serial console
A plain-text menu you reach through a direct cable or keyboard, not over the network. It still works when the web interface and the network are both down.