Packet arrives --> packet_monitor.py extracts IP/port/protocol --> rules.py decides ALLOW or BLOCK --> logger.py records the decision --> (if enforce=true) enforcer.py adds a real OS firewall rule ...