Simulator

ToolsCopy Anchor Link

• Verify a Filter Policy over Address and Port Sets
• Simulate a Packet
• Simulate a Config Change
• Explain Firewall Rule Reachability
• Run a Packet Suite

verify_filter_policyCopy Anchor Link

Verify a Filter Policy over Address and Port Sets · Risk: read

Exhaustively checks IPv4 source/destination ranges and port ranges using equivalence partitions, not sampling. Returns proved, violated with a counterexample and rule trace, or unknown. Supplied static export only; packet fields are at filter-chain entry, AFTER any destination NAT. This is NOT routing/NAT/IPv6/conntrack verification and cannot prove no WAN leak. Unsupported constructs, dynamic lists or >4096 cells fail closed to unknown. No router I/O.

simulate_packetCopy Anchor Link

Simulate a Packet · Risk: read

Traces a hypothetical packet through the router's NAT, routing and firewall — WITHOUT sending anything or changing anything. Answers 'would this get through, and which rule decides?' before Safe Mode is ever opened. Returns a step-by-step traversal naming each rule's chain, index and source line, so the reasoning can be checked rather than trusted. Reads a stored snapshot (snapshot_id), supplied text (config_text), or captures the live config with a read-only /export terse. Models IPv4 filter/NAT/routing only: no raw table, no queues, no layer7, no IPv6, and no live connection tracking (connection_state is declared by you, not inferred). Anything on the path that is out of scope downgrades the verdict to UNKNOWN rather than guessing.

simulate_changeCopy Anchor Link

Simulate a Config Change · Risk: read

Applies proposed configuration lines to a COPY of the config in memory, re-traces the same packet, and reports whether the verdict changed and at which step the paths diverged. This is the tool for 'would this rule break the VPN?' — pair it with plan_changes so a change is evaluated before it is applied. Nothing is sent to any device: the change exists only inside this simulation. Models IPv4 filter/NAT/routing only: no raw table, no queues, no layer7, no IPv6, and no live connection tracking (connection_state is declared by you, not inferred). Anything on the path that is out of scope downgrades the verdict to UNKNOWN rather than guessing.

explain_rule_reachabilityCopy Anchor Link

Explain Firewall Rule Reachability · Risk: read

Static analysis, no packet needed: which firewall rules can NEVER match because an earlier terminal rule in the same chain already matches everything they would? Deliberately conservative — only an exact-superset relation counts, because a false 'this rule is dead' gets a working rule deleted, which is worse than missing one. Complements firewall_audit's shadow detection with the simulator's own matcher model.

simulate_suiteCopy Anchor Link

Run a Packet Suite · Risk: read

Runs a set of packets with their EXPECTED verdicts — a regression test for the firewall. Declare the flows that must work ('LAN can reach the internet', 'WAN cannot reach SSH') and any change that breaks one is caught here rather than in production. Each packet reports pass/fail with the deciding rule; an UNKNOWN verdict counts as a failure, because a flow whose fate the model cannot determine is not a flow you have verified. Models IPv4 filter/NAT/routing only: no raw table, no queues, no layer7, no IPv6, and no live connection tracking (connection_state is declared by you, not inferred). Anything on the path that is out of scope downgrades the verdict to UNKNOWN rather than guessing.