Lessons · Cybersecurity · reading a firewall rule set
Reading a rule set from the top
A firewall checks each packet against its rules in order from the top, applies the first rule that matches and stops there, and a final rule denies everything nothing else matched.
Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.
What it is for
The new file server could not be reached and the ticket said the firewall was broken. It was not. Rule 4 allowed the traffic and rule 2, above it, denied it, so the packet never reached rule 4. Reading top down is the whole skill.
How to think about it
Write the packet's facts first: source address, destination address, protocol, destination port, direction. Then start at rule 1 and ask whether every field matches. The first yes decides. Reach the bottom and the default applies, and the default should be deny.
Worked example
Packet: from 10.1.2.50 to 10.1.9.20, TCP, port 445The facts, before any rule is read.
Rule 1: allow 10.1.2.0/24 to 10.1.9.10, TCP 443Destination is .20, not .10, and the port is 445. No match, so read on.
Rule 2: deny any to 10.1.9.0/24, TCP 445Every field matches. Deny, and stop reading.
Rule 3: allow 10.1.2.0/24 to 10.1.9.0/24, any portNever reached. This is the rule the ticket was written about.
Your turn
A packet reaches the bottom of the rule set and has matched nothing. Write what a well-built firewall does with it.
no rule matched, so the default is
Solve one, graded on the server
The trap
Reading the rules as a set instead of a list. Order decides everything: the same two rules in the other order give the opposite answer.