Distributed Firewall Control Plane OS Simulator is a production-style cybersecurity infrastructure simulator written in Modern C++17.
The project simulates the internal architecture of:
- Enterprise Firewalls
- Distributed Security Appliances
- Clustered Control Planes
- Packet Inspection Engines
- Stateful Session Tracking Systems
- Telemetry & Audit Pipelines
This simulator demonstrates real-world systems programming concepts including:
✅ Multi-threaded packet processing
✅ Distributed cluster simulation
✅ Firewall policy evaluation
✅ Stateful session tracking
✅ Audit logging
✅ Telemetry pipelines
✅ Thread pools
✅ Centralized logging
✅ Concurrent packet execution
✅ Production-style modular architecture
Modern enterprise firewalls rely on:
- distributed control planes
- concurrent packet processing
- telemetry systems
- stateful packet inspection
- audit pipelines
- scalable worker architectures
This project demonstrates these concepts in a simplified but production-inspired implementation.
It serves as a strong learning platform for:
- cybersecurity engineering
- distributed systems
- systems programming
- concurrent C++
- firewall architecture
- network security research
┌─────────────────────┐
│ Control Plane │
│ (core/controller) │
└─────────┬───────────┘
│
┌───────────────────────────┼──────────────────────────┐
│ │ │
▼ ▼ ▼
┌─────────────────┐ ┌──────────────────┐ ┌──────────────────┐
│ Cluster Manager │ │ Policy Engine │ │ Thread Pool │
│ Leader Election │ │ Rule Evaluation │ │ Worker Threads │
└────────┬────────┘ └────────┬─────────┘ └────────┬─────────┘
│ │ │
│ ▼ │
│ ┌──────────────────┐ │
│ │ Packet Flow Eval │ │
│ └────────┬─────────┘ │
│ │ │
▼ ▼ ▼
┌─────────────────┐ ┌──────────────────┐ ┌──────────────────┐
│ Session Tracker │ │ Audit Logger │ │ Telemetry Engine │
│ Active Sessions │ │ Security Events │ │ Metrics Summary │
└─────────────────┘ └──────────────────┘ └──────────────────┘
graph TD
A[Packet Arrival] --> B[Thread Pool]
B --> C[Policy Engine]
C --> D{Decision}
D -->|ALLOW| E[Session Tracking]
E --> F[Audit Logging]
F --> G[Telemetry Engine]
D -->|DENY| H[Audit Logging]
H --> G
graph LR
A[Control Plane] --> B[Thread Pool]
B --> T1[Worker 1]
B --> T2[Worker 2]
B --> T3[Worker 3]
B --> T4[Worker 4]
T1 --> P1[Packet Evaluation]
T2 --> P2[Packet Evaluation]
T3 --> P3[Packet Evaluation]
T4 --> P4[Packet Evaluation]
Distributed-Firewall-Control-Plane-OS-Simulator/
│
├── audit/
│ └── audit_logger.cpp
│
├── build/
│
├── cluster/
│ └── cluster_manager.cpp
│
├── core/
│ └── control_plane.cpp
│
├── policy/
│ └── policy_engine.cpp
│
├── session/
│ └── session_table.cpp
│
├── telemetry/
│ └── metrics.cpp
│
├── util/
│ ├── logger.cpp
│ └── logger.hpp
│
├── worker/
│ └── thread_pool.cpp
│
├── include/
│
├── docs/
│ ├── architecture.png
│ ├── runtime-preview.png
│ └── fwos-demo.gif
│
├── main.cpp
├── CMakeLists.txt
├── LICENSE
└── README.md
Responsible for:
- booting the firewall OS
- orchestrating subsystems
- scheduling packet flows
- launching worker threads
core/control_plane.cpp
Simulates distributed firewall clustering.
- leader election
- heartbeat service
- policy replication
[CLUSTER] node-1 elected leader
[CLUSTER] heartbeat service started
[CLUSTER] policy replication enabledEvaluates incoming network flows.
| Protocol | Port | Action |
|---|---|---|
| TCP | 443 | ALLOW |
| UDP | 53 | DENY |
[TRACE] 10.1.1.2 -> 8.8.8.8 proto=tcp port=443 verdict=ALLOWMaintains active connection state.
Simulates:
- conntrack
- NAT tables
- enterprise firewall sessions
[SESSION] active=42Generates security audit events.
Useful for:
- SOC monitoring
- SIEM ingestion
- incident response
- compliance auditing
[AUDIT] 10.1.1.42 -> 10.0.0.1 DENYTracks:
- allowed packets
- denied packets
- traffic statistics
- runtime metrics
========== FIREWALL SUMMARY ==========
allowed packets: 25
denied packets : 25Implements:
- concurrent packet processing
- worker scheduling
- asynchronous execution
This simulates real firewall packet pipelines.
Packet Arrives
│
▼
Thread Pool Worker
│
▼
Policy Engine Evaluation
│
├── ALLOW
│ │
│ ▼
│ Session Tracking
│ │
│ ▼
│ Audit Logging
│ │
│ ▼
│ Telemetry Metrics
│
└── DENY
│
▼
Audit Logging
│
▼
Telemetry Metrics
Install:
- GCC 13+
- CMake 3.16+
- Linux / WSL / GitHub Codespaces
g++ --version
cmake --versiongit clone <repository-url>
cd Distributed-Firewall-Control-Plane-OS-Simulatormkdir build
cd buildcmake ..-- Configuring done
-- Generating done
-- Build files have been written to:make -j4[100%] Built target fwos-x./fwos-x[FWOS] booting distributed firewall OS
[CLUSTER] node-1 elected leader
[CLUSTER] heartbeat service started
[CLUSTER] policy replication enabled
[POLICY] loaded 2 rules
[SESSION] active=1
[AUDIT] 10.1.1.0 -> 10.0.0.1 DENY
[TRACE] 10.1.1.0 -> 10.0.0.1 proto=tcp port=443 verdict=DENY
[SESSION] active=2
[AUDIT] 10.1.1.1 -> 8.8.8.8 DENY
[TRACE] 10.1.1.1 -> 8.8.8.8 proto=udp port=53 verdict=DENY
[SESSION] active=3
[AUDIT] 10.1.1.2 -> 8.8.8.8 ALLOW
[TRACE] 10.1.1.2 -> 8.8.8.8 proto=tcp port=443 verdict=ALLOW
========== FIREWALL SUMMARY ==========
allowed packets: 25
denied packets : 25
[FWOS] shutdown completeThe simulator uses:
ThreadPool pool(4);This launches:
- 4 worker threads
- concurrent flow processing
- asynchronous packet evaluation
✅ Better throughput
✅ Realistic packet scheduling
✅ Parallel execution
✅ Scalable architecture
The simulator uses:
std::mutex globalLogMutex;Purpose:
- synchronized console output
- prevents log corruption
- thread-safe tracing
[TRACE] [SESSION] active=10.1.1.42[SESSION] active=42
[AUDIT] 10.1.1.42 -> 10.0.0.1 DENY| Metric | Description |
|---|---|
| Allowed Packets | Successful flows |
| Denied Packets | Blocked flows |
| Active Sessions | Connection count |
| Audit Events | Security logs |
| Technology | Simulated |
|---|---|
| Firewall Control Plane | ✅ |
| Distributed Systems | ✅ |
| Session Tracking | ✅ |
| Thread Pools | ✅ |
| Packet Inspection | ✅ |
| Cluster Replication | ✅ |
| Telemetry Pipelines | ✅ |
| Audit Logging | ✅ |
| Concurrent Processing | ✅ |
| Policy Evaluation | ✅ |
- Modern C++17
- Multithreading
- Mutex Synchronization
- Distributed Systems
- Network Security
- Firewall Architecture
- Thread Pools
- Session Tracking
- Telemetry Systems
- Concurrent Programming
- Linux Systems Programming
- CMake Build Systems
Using:
nlohmann/jsonExample:
{
"protocol": "tcp",
"port": 443,
"action": "allow"
}Possible libraries:
- Boost.Beast
- Crow
- Pistache
Endpoints:
/metrics
/rules
/flows
/sessions
Integrations:
- libpcap
- raw sockets
- eBPF
Potential integrations:
- ncurses UI
- Grafana exporter
- Prometheus metrics
┌───────────┐
│ Leader │
└─────┬─────┘
│
┌───────────┼───────────┐
▼ ▼ ▼
┌────────┐ ┌────────┐ ┌────────┐
│ Node-2 │ │ Node-3 │ │ Node-4 │
└────────┘ └────────┘ └────────┘
| Feature | Current |
|---|---|
| Worker Threads | 4 |
| Packet Flows | 50 |
| Logging | Thread-Safe |
| Architecture | Modular |
| Build System | CMake |
| Language | C++17 |
cd /workspaces/Distributed-Firewall-Control-Plane-OS-Simulator
rm -rf build
mkdir build
cd build
cmake ..
make -j4./fwos-xls -l ./fwos-xrealpath ./fwos-xThe simulator mimics:
- ACL Enforcement
- Stateful Firewalling
- Traffic Filtering
- Security Audit Pipelines
- Distributed Control Planes
- Runtime Telemetry
- Session Management
- Packet Classification
Create:
.github/workflows/build.yml
Example:
name: C++ Build
on:
push:
pull_request:
jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Install Dependencies
run: sudo apt-get install -y cmake g++
- name: Build Project
run: |
mkdir build
cd build
cmake ..
make -j4Built using:
- C++17
- Modern concurrency
- Linux threading
- CMake
- Distributed systems concepts
- Cybersecurity architecture principles
MIT License
If you found this project useful for learning:
- distributed systems
- firewall architecture
- cybersecurity engineering
- multithreaded C++
- packet processing
- systems programming
consider giving it a ⭐ on GitHub.