Firewall

Rules overview

Firewall: A Cybersecurity Trick-Taking Game Players: 4 (2 vs 2, partners seated opposite) Age: 10+ Time Frame: 40–60 min Match End: First to 35 points or after 5 rounds, whichever comes first.

Game Overview

Firewall is a strategic partnership trick-taking game where two players form the Red Team (offensive hackers) and two form the Blue Team (defensive sysadmins). Red seeks to exploit vulnerabilities by taking tricks, while Blue tries to protect the system by taking tricks and placing defenses. The core mechanism involves players using a Fortify action to set a Cap (maximum winning card rank) on suits, which the opposing team must then work to Decay or bypass.

1. Components

• 1 standard 52-card deck (A high, 2 low)
• 3 DDoS tokens (distinct markers)
• 1 Chain marker and Max Chain tracker for the Red Team
• Optional: 4 Fortify State Markers (to track Fresh/Worn)

2. Setup

1. Teams: Form two teams: Red Team (Attackers) and Blue Team (Defenders). Partners sit opposite each other.
2. Firewall: Create four Suit Stacks in the center (Hearts, Diamonds, Clubs, Spades). All stacks start empty.
3. DDoS Supply: Place the 3 DDoS tokens in a shared supply.
4. Chain Tracker: Set the Max Chain tracker to 0.
5. Dealing: Deal all 52 cards, 13 to each player.
6. Lead: The player with the 2 of Clubs leads the first trick of Round 1.

3. Gameplay

A Match consists of several Rounds. A Round ends when all 13 tricks have been played.

A. The Trick

1. Lead: The current leader plays any card from their hand face-up. This is the Lead Suit.
2. Follow Suit: Players proceed clockwise, playing one card each. Players must play a card of the Lead Suit if they have one.

• If a player cannot follow suit, they may play any card (trump, off-suit, or a card from a capped suit).

B. The Firewall: Caps and Blackholed Cards

The Firewall rules determine which cards are valid to win the trick:

• Cap: A card placed face-up on a Suit Stack sets the Cap (maximum winning rank) for that suit. The cap rank is the rank of the card (e.g., a 7 sets the cap at 7).
• Blackholed Cards: A card of the Lead Suit that has a rank higher than the current Cap is considered Blackholed.
• Blackholed cards CANNOT win the trick.
• They CAN still be played if following suit is mandatory.

C. Winning the Trick

After all four cards have been played, the trick is resolved:

1. Trick Winner: The highest card of the Lead Suit that is not Blackholed wins the trick.
2. Edge Case: If all played cards of the Lead Suit are Blackholed (i.e., they are all above the Cap), then the player who led the trick takes the trick, but cannot perform a Fortify action.
3. The winner places the four trick cards face-down into their team's trick pile.

D. Trick Winner's Action

Only the player who won the trick (except in the Blackholed Edge Case) must immediately choose one of two actions:

Pace Rule: The winning team has 15 seconds to discuss and declare their chosen action (Fortify or Cyber Attack). While the action is performed only by the trick winner, the choice must be a team decision. Once the trick winner declares the action, it cannot be reversed.

1. Fortify: Place a defense card on the Firewall.

• Process: The trick winner chooses any one card from the four cards just played in the trick and places it face-up on its matching Suit Stack. This card must be of a suit that appeared in the trick.
• Cap Status: The new Cap is set to the rank of the chosen card and is marked as Fresh (e.g., by using a marker or card orientation).

Example Application

• Trick Play: P1 leads Heart 5. P2 plays Heart 9. P3 plays Diamond 2. P4 plays Heart J (Partner of P1). P4 wins with the Heart J (assuming the Heart cap was high or the suit was uncapped).
• Trick Winner's Choice (P4): P4's team (Red or Blue) won the trick. P4 now examines the four cards they just won: Heart 5, Heart 9, Diamond 2, Heart J.
• Fortify Action: P4 may choose any of these four cards to Fortify its matching suit stack.
• P4 could Fortify Hearts with the Heart 5 (setting a low Cap of 5).
• P4 could Fortify Diamonds with the Diamond 2 (setting a low Cap of 2).
• P4 could not Fortify Clubs or Spades, because those suits did not appear in the trick.

1. Launch a Cyber Attack: Execute one of the following tactical actions. Only one of these may be chosen per trick:

• Sniffer (Intelligence): Look at all cards of one named suit in a single opponent’s hand.
• Rootkit (Swap): Once per player per round. Swap one card from your hand with one card from your partner’s hand (without showing the rest of your hands).
• Rewrite Rules (Remove Cap): Once per team per round. Remove the top Cap card from any Suit Stack and place it in the team's trick pile.
• Take DDoS Token (Supply): Take one DDoS token from the supply into your personal possession.

E. Tracking the Red Team Chain

The Chain tracks the number of consecutive tricks won by the Red Team.

1. Start/Reset: The Chain starts at 0 at the beginning of the round. It resets to 0 if the Blue Team wins a trick.

2. Tracking

• If the Red Team wins the current trick, they increment their Chain counter by 1.
• If the Blue Team wins the current trick, the Chain counter resets to 0.

1. Maximum Chain: After the Red Team wins a trick, check if the current Chain length is greater than the team's standing Max Chain. If it is, update the Max Chain tracker to the new, higher value. The Max Chain persists even if the current Chain is subsequently broken.

F. The DDoS Interrupt

If a trick winner declares Fortify, either opponent (Red or Blue) may spend one DDoS token immediately to interrupt.

1. Effect: The Fortify action is canceled.
2. Scoring: The team that spent the DDoS token scores +1 Point immediately.
3. Lead Change: The player who spent the DDoS token leads the next trick.
4. The original trick winner still takes the trick cards, but performs no action (neither Fortify nor Cyber Attack).

G. Cap Decay

Caps on the Firewall are not permanent; they Decay when their suit is led.

1. Fresh → Worn: When a suit with a Fresh cap is led, the cap remains in place for this trick. After the trick is resolved and the winner’s action is taken, the cap moves to Worn.
2. Worn → Gone (Decay): The next time a suit with a Worn cap is led:

• Before any player plays a card to the trick, remove the cap card from the Firewall and place it in the trick winner's pile (as if it was part of the trick).
• This suit is now uncapped for this trick (and subsequent tricks), meaning the highest card of the lead suit will win.

1. If a new Fortify occurs, the Decay state resets to Fresh.

4. Scoring

Scoring occurs at the end of each Round after all 13 tricks have been played.

End of Round Clean-up

1. Score is tracked.
2. All Cap cards on the Firewall are cleared and added to the Blue Team's score pile (they earned them by keeping them active).
3. Used DDoS tokens are returned to the supply.
4. DDoS Refresh: Each player starts the new round with one new DDoS token (or refreshes their current one if they didn't spend it).
5. The player to the left of the previous round's leader leads the next Round.

The match ends when a team reaches 35 points or after 5 rounds are complete.

________________

Examples of Play & Edge Cases

Example 1: Trick Winning with Blackholed Cards

• Setup: Hearts has a Cap of 8 (Fresh). Hearts is led.
• Play: Heart 5, Heart J (Blackholed: 11 > 8), Heart 8, Heart 3.
• Result: The Heart 8 wins (highest non-blackholed card). The Heart Cap moves Fresh → Worn (Decay).

Example 2: Complete Decay and Uncapped Winning

• Setup: Spades has a Cap of 4 (Worn). Spades is led.
• Action: Before playing cards, the Cap 4 is immediately removed and the suit is uncapped for this trick.
• Play: Spade 9, Spade J, Spade A, Spade 10.
• Result: The Spade A wins (highest card in an uncapped suit). The winner collects the four trick cards and the removed Cap 4 card.

Example 3: All Cards Blackholed (Edge Case)

• Setup: Clubs has a Cap of 9 (Fresh). Clubs is led.
• Play: Club J, Club K, Club Q, Club 10. (All are > Cap 9).
• Result: The trick leader (Player A) takes the trick cards. Player A performs no action (no Fortify or Cyber Attack). The Club Cap moves Fresh → Worn (Decay).

Example 4: The DDoS Interrupt

• Action: Red wins a trick and declares: "I will Fortify Diamonds with the Diamond 7."
• Interrupt: Blue spends a DDoS token, "DDoS! I interrupt the Fortify."
• Result: Fortify is canceled. Blue scores +1 Point. Red collects the cards but performs no action. Blue leads the next trick.