How it works

    1. Topology. You place devices on the canvas and connect their interfaces. Each interface has a MAC and IP address.

    2. Rules. On each device, you configure a firewall using iptables syntax. RuleForge evaluates packets through iptables-style chains — PREROUTING, INPUT, FORWARD, OUTPUT, POSTROUTING — with rules that ACCEPT, DROP, REJECT, DNAT, SNAT, or MASQUERADE, plus a default policy.

    3. Simulation. A simulated packet hops device to device. At every hop you see which chain ran, which rule matched, and how NAT rewrote the addresses — until the packet is delivered or dies, with the exact rule that killed it.

    What's modeled — and what isn't

    Modeled

    • iptables chains and policies
    • ACCEPT, DROP, REJECT, DNAT, SNAT, MASQUERADE
    • Bidirectional packet flow
    • NAT address/port rewriting
    • Multi-hop routing via link topology

    Not modeled

    • Connection tracking / stateful rules (roadmap)
    • Real packet payloads or timing
    • Routing protocols (BGP/OSPF) — paths follow your links
    • nftables-specific semantics

    Keyboard shortcuts

    KeysAction
    ⌘+SSave project
    ⌘+ZUndo
    ⌘+⇧+ZRedo
    DelDelete selected node
    ⌘+↵Run simulation
    EscDeselect / Close panel

    Export & CLI

    Export any project as JSON from the builder header. Re-run its simulations headlessly:

    npm run cli -- my-project.json