Free interactive firewall rule simulator. Build rulesets, craft test packets, and trace rule matching with stateful/stateless inspection modes.
This is a hands-on model of how a firewall evaluates traffic. You build a ruleset, send test packets against it, and watch which rule matches and what action fires. It makes the abstract logic of packet filtering concrete — and surfaces the mistakes that bite real deployments:
Most firewalls evaluate rules top-down and stop at the first match. That means a broad rule placed above a specific one can silently shadow it — the specific rule never executes. A common failure is an allow that sits above a deny it was meant to be constrained by. The simulator lets you see this directly instead of discovering it in production.
Understanding the difference explains why a stateless ruleset needs more rules and is easier to get wrong.
Everything runs locally in your browser — no rules or test data leave your machine.
Stateless firewalls evaluate each packet independently against the rule set without tracking connection state. Stateful firewalls maintain a connection state table and can allow return traffic for established connections automatically. Stateful inspection is more secure as it understands the context of network conversations.
Firewalls typically use first-match processing: packets are compared against rules from top to bottom, and the first matching rule determines the action. Placing specific allow rules before broad deny rules ensures desired traffic passes. A misplaced rule can block legitimate traffic or allow unauthorized access.
Most firewalls include an implicit deny rule at the end of the rule set that blocks any traffic not explicitly permitted by previous rules. This follows the principle of least privilege. Without implicit deny, unmatched traffic would pass through, creating a security gap. This tool includes implicit deny by default.
This simulator lets you craft test packets with specific source/destination IPs, ports, and protocols, then traces them through your rule set to show which rule matches and what action is taken. Test with both legitimate traffic (should be allowed) and attack scenarios (should be blocked) to verify your rules work correctly.
A DMZ (Demilitarized Zone) is a network segment between the external and internal networks that hosts publicly accessible services like web servers and email. DMZ architecture typically uses two firewalls or a single firewall with three interfaces. The pre-built DMZ ruleset in this tool demonstrates proper DMZ rule configuration.
Comprehensive database of common network ports and their associated services
Calculate IPv4/IPv6 subnets instantly. Get network ranges, subnet masks, usable hosts & CIDR notation. Free professional tool - no registration needed.
Plan wireless network deployments with protocol comparison (WEP through WPA3), 802.11 standard analysis (a/b/g/n/ac/ax/be), antenna selection guidance, security configuration checklists, and rogue AP detection strategies. Generate deployment plans with PDF export.