FIREWALL://BORDER

You are the midnight-shift firewall officer at **Gateway 7**. Read each incoming packet's source, destination subnet, port, route seal, permit, payload, and last hop. Approve clean traffic. Deny North Coreaa's takeover attempts. Five shifts. Three breaches and the core falls.

## What's in the box

- A seven-page plain-language orientation with an interactive practice packet.

- Five shifts, each adding one layer of checks: source, destination subnet, port, route seal, permit expiry, encoded payloads, and spoofed routes.

- Desk tools: subnet checker, seal scanner, permit checker, base64 payload scanner, threat feed, and route trace. Tools cost analysis cores; the Field Manual is free.

- DDoS and AI-forgery events that grow the queue mid-shift.

- ASCII CRT presentation, bleeps, a packet rain background, keyboard shortcuts, desktop and mobile layouts.

- A Field Manual written for non-technical humans, with analogies for IPs, subnets, ports, seals, and permits.

- Local best-score tracking.

## Controls

| Key | Action |

| --- | --- |

| `A` | Approve the current packet |

| `D` | Open denial reasons |

| `1`–`7` | Choose a denial reason |

| `M` | Field Manual (free; pauses the clock) |

| `P` | Pause |

| `Esc` | Close a menu / cancel a denial |

| `Enter` | Continue through reports and feedback |

The shift clock pauses in every menu and report. The pressure comes from the queue, not from being punished for reading the manual.

## How to win

Every shift's checklist is authoritative. A strange-looking field that is not on today's list is not a reason to deny. For active checks:

1. **Source** — is the source IP inside an allowed network?

2. **Destination** — is the destination IP inside the subnet of the service it claims?

3. **Port** — does the port/protocol match that service's door?

4. **Seal** — does the route seal match today's registry exactly?

5. **Permit** — is it for the right service and valid at arrival time?

6. **Payload** — does the decoded cargo match a threat signature?

7. **Route** — is the last hop PYG-IX? Then it is North Coreaa.

Three wrong approvals end the watch. Denying clean traffic costs public trust and credits. The ending depends on holding all five shifts.