Stateful Firewall & DPI

nftables firewall appliance with stateful rules

Firecradle inspects every packet, tracks every connection's state, and enforces a priority-ordered rules engine built on direction, protocol, source/destination, and port ranges - with deep packet inspection layered on top.

IT Director / CIO
  • Zone-based policy with clear allow/block/reject outcomes
  • Per-rule logging for audit and compliance evidence
  • No specialist required to add or reorder a rule
  • Connection tracking gives real-time visibility into live sessions
Network / Security Admin
  • Direction, protocol, source, destination, and port-range matching
  • First-match priority ordering with drag-and-drop reorder
  • Deep packet inspection beyond header matching
  • Connection states (NEW/ESTABLISHED/RELATED/INVALID) visible per session
System Administrator
  • Enable/disable a rule without deleting it
  • Reject vs. block per rule for different failure behavior
  • Configuration backup and one-click rollback before risky changes
  • Centralized rule management from the cloud dashboard

Anatomy of a Firewall Rule

Every rule is built from the same eight fields. Combine them to express anything from a single-port allow to a broad zone policy.

Direction
Inbound, outbound, or bidirectional - control which way traffic is allowed to flow through each interface.
Protocol
Match on TCP, UDP, ICMP, or all protocols - down to the exact conversation you want to permit or deny.
Source & Destination
Any, a specific network (CIDR), a single host, or a named group/alias - on both sides of the rule.
Port Ranges
Single ports or ranges (e.g. 8000-8100), so one rule can cover an entire service block.
Action
Allow, block, or reject - reject sends an explicit refusal back to the sender instead of silently dropping it.
Priority & Ordering
Rules are evaluated in priority order with first-match-wins semantics. Drag-and-drop reordering, no config file editing.
Per-Rule Logging
Toggle logging independently on every rule, so noisy allow rules don't drown out the traffic you actually want to audit.
Enable / Disable
Flip a rule off without deleting it - useful for temporary maintenance windows or staged rollouts.
Example Rule
Priority 100Direction: inboundProtocol: tcpSource: 192.168.1.0/24Destination: anyPort: 22Action: allowLogging: on
"Allow SSH from the admin subnet" - matched, logged, and evaluated before any lower-priority catch-all rule.
Connection Tracking

Stateful Means the Firewall Remembers

A stateless packet filter re-evaluates every packet against the full rule list. Firecradle's connection tracker remembers the state of every flow, so return traffic for a connection you already allowed doesn't need to walk the rule set again - it's matched directly from connection state. Anything that doesn't belong to a recognized flow is treated as invalid and dropped.

NEW
The first packet of a connection. The firewall checks it against the rule set to decide whether the whole connection is allowed.
ESTABLISHED
A connection that has already completed its handshake and seen traffic in both directions - matched automatically without re-checking every rule.
RELATED
A new connection that is related to an existing one (e.g. an FTP data channel opened by an active FTP control connection).
INVALID
Packets that don't fit any known connection - malformed, out-of-sequence, or spoofed traffic. Dropped by default.
Live Connection Detail
Protocol
tcp
Source
192.168.1.100:54321
Destination
8.8.8.8:443
State
ESTABLISHED
Packets in / out
1,500 / 2,000
Bytes in / out
128 KB / 256 KB
Deep Packet Inspection

Beyond IP Addresses and Port Numbers

Header-only filtering trusts that traffic on port 443 is actually HTTPS. Firecradle's DPI engine inspects packet contents against the connection state, catching traffic that doesn't match its declared protocol or that carries a known-bad signature - feeding directly into rule-based threat detection.

  • Protocol validation - flags traffic that doesn't match its stated port/protocol
  • Works in line with the connection tracker, not as a separate bolt-on pass
  • Feeds signature-based intrusion detection and prevention
  • No black-box AI/ML - every match traces back to a rule or signature
Packet Evaluation Path
Packet Arrives on Interface
Connection Tracker Checks State
DPI Inspects Contents vs. Declared Protocol
Rule Engine Evaluated in Priority Order
Action Applied: Allow / Block / Reject
Logged if Rule Has Logging Enabled

Real-World Use Cases

Exposing an Internal Web App Safely

Challenge: A small business needs to publish an internal web app to the internet without opening the whole network.

How it's handled:
✅Inbound rule: TCP 443 only, destination = web server host
✅Priority placed above the default-deny catch-all
✅Logging enabled on the rule to track every connection attempt
✅Everything else on that host stays unreachable from the WAN

Standardizing Policy Across MSP Client Sites

Challenge: An MSP manages a dozen client firewalls and needs consistent baseline rules with per-site exceptions.

How it's handled:
✅Baseline rule set pushed to every appliance from the cloud dashboard
✅Connection tracking gives each site's admin real-time visibility into active sessions
✅Per-rule logging feeds a unified audit trail across all client sites
✅Site-specific rules layered on top without touching the shared baseline

Key Advantages

✅Full rule control: direction, protocol, source/destination, port ranges, priority
✅Stateful by design: connection tracking means return traffic is matched from connection state
✅DPI included: packet contents checked, not just headers
✅Reject or block per rule: choose the failure behavior that fits the situation
✅Auditable: per-rule logging plus configuration backup and rollback

A Firewall That Knows the State of Every Connection

Stateful rules engine, connection tracking, and DPI included in every Firecradle appliance.

In development · early access · Onboarded hands-on by our team