A method for handling ingress packets at a telecommunications endpoint, said telecommunications endpoint being a communication appliance that include a deskset, a conferencing unit, a cellular telephone, a desktop or portable computer, i.e. "softphone" and providing for its user access to a telecommunications system and wherein the endpoint is capable of i) receiving a voice signal from said user of the endpoint, ii) digitizing the voice signal, iii) transmitting a plurality of egress packets that comprise the digitized voice signal and is also capable of receiving ingress packets and converting the information contained within those ingress packets into voice signals that are understandable by the communication appliance's user, said method comprising: executing a firewall engine and a phone application at said endpoint that receives said ingress packets, wherein said executed and thus running phone application can exhibit at least a booting state, in which only signalling messages from a specific network node, such as a gatekeeper, and trivial fife transfer protocol (TFTP) packets that possibly contain a new load image should be accepted, a discovery state, in which only signalling messages that are consistent with endpoint 204- s searching for and registering with a gatekeeper should be accepted, an on-hook state, in which only signaling messages ( e.g., heartbeats, etc.) from the gatekeeper should be accepted, and an off-hook state, in which only media and signalling traffic should be allowed, as distinct operational states; when a state change in the operational state of said phone application occurs during the execution of said phone application, notifying said firewall engine of said state change, wherein the phone application performs the notifying; and applying different sets of firewall or packet-classification rules in each operational state by selecting based on such state change a corresponding first set of packet-classification rules comprising a first rule and filtering at least one of said ingress packets, based on said first set of packet-classification rules; and when said application, during its execution, exclusively anticipates that said ingress packets are to exhibit a predetermined characteristic, making a second rule available to said firewall engine as part of said first set of packet-classification rules, wherein the second rule is made available by the application. executing a firewall engine and a phone application at said endpoint that receives said ingress packets, wherein said executed and thus running phone application can exhibit at least a booting state, in which only signalling messages from a specific network node, such as a gatekeeper, and trivial fife transfer protocol (TFTP) packets that possibly contain a new load image should be accepted, a discovery state, in which only signalling messages that are consistent with endpoint 204- s searching for and registering with a gatekeeper should be accepted, an on-hook state, in which only signaling messages ( e.g., heartbeats, etc.) from the gatekeeper should be accepted, and an off-hook state, in which only media and signalling traffic should be allowed, as distinct operational states; when a state change in the operational state of said phone application occurs during the execution of said phone application, notifying said firewall engine of said state change, wherein the phone application performs the notifying; and applying different sets of firewall or packet-classification rules in each operational state by selecting based on such state change a corresponding first set of packet-classification rules comprising a first rule and filtering at least one of said ingress packets, based on said first set of packet-classification rules; and when said application, during its execution, exclusively anticipates that said ingress packets are to exhibit a predetermined characteristic, making a second rule available to said firewall engine as part of said first set of packet-classification rules, wherein the second rule is made available by the application.