Firewall Simulation

A stateful firewall simulation written in Go that models packet filtering, rule-based access control, and connection state tracking.

Overview

This project simulates the core behaviour of a stateful network firewall. It generates randomised inbound and outbound network traffic, applies deny/allow rules based on IP address and port, and tracks active connections in a state table — automatically expiring stale entries over time.

Built as a learning exercise in Go concurrency, network concepts, and security-focused programming.

Features

• Packet generation — produces 200–500 randomised packets with either private or public IP addresses across common ports (22, 25, 53, 80, 110, 443, and a random port)
• Rule engine — generates 5–250 firewall rules targeting packets on vulnerable ports; each rule is keyed by IP + port and assigned an allow or deny action
• Stateful inspection — outgoing allowed packets create entries in a connection state table; subsequent inbound packets matching an established connection are automatically permitted
• State table cleanup — a background goroutine purges stale connections after a 30-second inactivity timeout
• Traffic simulation — inbound and outbound packets are shuffled together and processed sequentially with a short delay, simulating a live traffic feed

How It Works

1. makePackets() generates a mix of safe (private/loopback) and unsafe (public) packets
2. createRules() builds a rule map targeting packets on known vulnerable ports
3. Traffic is combined into a []DirectedPacket slice and shuffled
4. Each packet passes through checkStateful(), which:
   • Allows packets belonging to an established connection (state table hit)
   • Falls back to rule lookup, defaulting to allow if no rule matches
   • Adds new outgoing allowed connections to the state table
5. Results are printed to stdout in a formatted log

Example Output

--- Firewall Simulation Starting ---
[Outgoing] Action: allow              | IP: 192.168.1.45    | Port: 443
[Ingoing]  Action: deny               | IP: 203.0.113.12    | Port: 22
[Ingoing]  Action: allow (established)| IP: 192.168.1.45    | Port: 443

Requirements

• Go 1.22+ (uses math/rand/v2)

Running

git clone https://github.com/KieranPritchard/Firewall-Simulation-Update.git
cd Firewall-Simulation-Update
go run firewall_simulation.go

Project Structure

Firewall-Simulation-Update/
├── firewall_simulation.go   # Main simulation logic
└── go.mod                   # Go module definition

Key Concepts Demonstrated

• Struct-based data modelling (Packet, RuleKey, Connection, DirectedPacket)
• Concurrent state management with sync.Mutex
• Background goroutines for periodic cleanup
• IP parsing and classification via the net package
• Randomised simulation with math/rand/v2

Author

Kieran Pritchard