From 1.1.30, Firewall › Rules shows your security rules as a full-width flow diagram above the rule table: where traffic comes from, what Korthveil does with it, and where it goes. Every change you make in the table (add, edit, enable or disable, delete, move) is drawn within a second, including which rule wins, before you commit.

From 1.1.33 the page reads top to bottom: What would you like to do? (Easy mode), the rule flow with moving arrows, the Auto-rule suggestions, then the rule table.

Start from what you want to do (Easy and Expert)

The switch Easy / Expert at the top of the page is remembered for your account. Easy (the default) shows the actions; Expert hides them and keeps the flow and the full table.

• Let devices browse the web: a zone gets web access (HTTP, HTTPS, QUIC) and, if you want, DNS to the firewall.
• Connect two networks: one network reaches one server on one service.
• Publish a service: opens the port forward wizard (from the internet to a server inside).
• Block access: first asks a device or group, from the internet or a service, everywhere.
• Create VPN access: a VPN zone reaches a network.
• Why is this blocked?: opens Test a connection (below).
• Ask AI: describe the rule in a sentence; only when the AI assistant add-in can draft rules, otherwise the card says why it is off.

The wizard asks one question per screen, with Back and a So far box with your answers:

The last step, Check the rule, asks Korthveil to build the rule: the exact rule with its automatic name, where it goes in the list, its risk, and what the rule checker finds (for example rules that become redundant). If a rule already does the same, it offers Use existing rule instead.

Nothing is applied yet. Preview adds the rule to the pending changes and the flow draws it as Preview; Edit opens the rule editor with it; Apply opens Review and commit (with the safety rollback). Cancel leaves everything as it was.

Reading the diagram

• Left: your internal zones (LAN, guest, IoT, VPN users, management …) with their networks. Right: the internet and other external zones (WAN, DMZ). Any zone stands for rules that apply to every zone.
• Middle: Korthveil, with its stages in the real order of the data plane: port forwards, floating rules, security rules, source NAT. The first rule that matches decides; what no rule allows is dropped (Default: deny the rest).
• One path per rule:
• green, solid: allowed; the path reaches its destination;
• red, dashed, with ✕: blocked; the path stops at the firewall: the traffic never reaches the zone on the right;
• orange, dotted: never wins: an earlier rule already decides all of its traffic;
• grey, dotted: switched off, or its schedule is not active right now.
• Moving arrows show the direction and what the rules decide: on allowed paths they travel from the source zone through Korthveil to the destination; on blocked paths they run into the firewall and fade at the ✕; rules that never win or are off do not move. They show the rules, not measured traffic (that is Live, below). Pause motion stops them; Slow / Normal / Fast sets the pace; both are remembered for your account. An arrowhead marks where each path enters the firewall.
• Header: Active policy · revision N (the running rules) or Preview (pending changes) when you have changes not committed yet; the counters (rules, allowing, blocking, never win, off).

The statuses come from Korthveil's rule checker on the rules shown, not from the browser: the same checker that warns on Review and commit.

One rule at a time: is it working?

Press a path, or a row of the table (both select the same rule). Only that rule's flow is drawn, and the box under the diagram answers is this rule working?, from the rule checker and the rule's hit counters:

Press the rule again, or Show all, to see every path again.

• Never wins (#N decides): move the rule above #N, or remove it.
• #N decides part: normal for an exception above a general rule; move it if this rule should win for the overlapping traffic.

Change rules and watch the flow

Edit the table as always: Add rule, the pencil, the switch, drag or the arrows, delete. The diagram turns to Preview (pending changes) and redraws within a second. Nothing is applied until Review and commit (with the safety rollback); after the commit the header shows the new revision as Active policy.

Test a connection

Test a connection (also Simulate next to Add rule, and Why is this blocked?) asks Korthveil what happens to one connection: from zone (or source address), to zone (or destination address or object), protocol and port. The answer is the rule that decides, with NAT and route, and the diagram marks every rule that was compared on the way and why it did not match. It is a policy trace: no packets are sent.

Live

The Live switch replaces the arrows with moving dots on the paths that carry measured traffic right now; their speed follows the measured rate and the panel says when it was measured. Rules without traffic stay still. In Preview, nothing moves: a pending rule has no traffic yet. If the firewall has no traffic data, the panel says Live data not available instead of animating. With reduce motion set on your computer, the rates are written on the paths instead.

Good to know

• Big rule sets (more than about 60 rules) are grouped per zone pair; press a group to open it.
• Phones and narrow windows show the same rules as cards: source → firewall → destination.
• The diagram can be collapsed (the arrow next to Rule flow); your choice is remembered.
• Floating rules and port forwards appear as their stages in the middle; a port forward's traffic is checked by the rules after its translation.

The pictures are from the test firewall (versions 1.1.30 and 1.1.33).