Control traffic with firewalls
Write rules that let the right traffic through and stop the rest.
- Predict the result of a first-match rule list.
- Explain default deny and stateful filtering.
- Use network segments to limit the damage of a breach.
You now know what fills every header. A firewall uses those same fields to decide what's allowed: source and destination address, protocol and port. Most firewall trouble doesn't come from a wrong rule, though. It comes from rules in the wrong order.
First match wins
Most firewalls read their rules from the top down and stop at the first rule that matches. That's different from routing, where the most specific route wins whatever its position.
Good rule lists end with default deny: anything not explicitly allowed is blocked, so forgetting a rule breaks a feature rather than opening a hole.
Try it
Fix the rule order
Every rule here is reasonable, but the order is wrong. Use the arrows to reorder them until all the traffic gets the right verdict. Each flow shows which rule caught it, so start from one that's wrong and ask what caught it too early.
The best possible solution takes five moves. Can you match it?
Rules, checked top to bottom
- 1AllowHTTPS from anywhere
- 2DenySSH from anywhere
- 3AllowSSH from the office
- 4AllowDatabase from the office
- 5DenyEverything from the blocklist
- –Anything else: denied by default
Traffic
- A customer loads the site (internet, 443)Should pass. Matched rule 1: Allow.
- An admin logs in (office, 22)Should pass. Matched rule 2: Deny.
- A stranger tries SSH (internet, 22)Should be blocked. Matched rule 2: Deny.
- A known attacker probes the site (blocklist, 443)Should be blocked. Matched rule 1: Allow.
- A developer queries the database (office, 5432)Should pass. Matched rule 4: Allow.
- A stranger tries the database (internet, 5432)Should be blocked. No rule matched, so it's denied by default.
2 flows have the wrong verdict.
Stateful firewalls
If a firewall denies all inbound traffic, how do replies to your own requests get back? A stateful firewall remembers the connections it has allowed out, and lets their return packets back in automatically. You met the same idea with the NAT table. Almost all modern firewalls work this way, so you write rules for the side that starts a connection.
1rules = [
2 ("allow", "office", 22),
3 ("deny", "any", 22),
4 ("allow", "any", 443),
5]
6
7def check(source, port):
8 for action, rule_source, rule_port in rules:
9 if rule_source in ("any", source) and rule_port == port:
10 return action
11 return "deny (default)"
12
13print(check("office", 22))
14print(check("internet", 22))
15print(check("internet", 443))
16print(check("internet", 25))allow deny allow deny (default)
Segmentation: assume something gets in
A single firewall at the edge is like a castle wall: once an attacker is inside, everything is reachable. Segmentation divides a network into zones, using subnets and VLANs, with filtering between them. A web server can reach the database on one port, but a compromised laptop can't reach the database at all.
This follows the principle of least privilege: each system can reach only what it needs. Everything you learned about subnets is what makes this possible.
Try it
Which zone does it belong in?
You're laying out a company network with three zones. The public zone is reachable from the Internet, the internal zone is for staff, and the restricted zone holds the most sensitive systems. Place each system where it can do its job with the least exposure.
“The company website”
“Staff laptops”
“The customer database”
“The office printer”
“The payment system”
Key takeaways
Firewalls match header fields, and the first matching rule decides.
End with default deny, and let stateful tracking handle replies.
Segmentation limits how far an attacker can move after getting in.
Lesson quiz
7 questions · pass with 5 correct · up to 50 XP
Passing this quiz completes the lesson and keeps your streak going. Questions you miss come back in review sessions later.
Practice: model networking concepts
Use small Python programs to model packet, address, and protocol behavior. These exercises run locally in your browser and do not send network traffic.
Evaluate a rule list
The rules are given as action port pairs. Read a port and print the action of the first matching rule, or deny if none match. * matches any port.
- Allowed port
- Denied port
- Caught by the wildcard
Python runs in a sandboxed browser worker with a 60 second time limit. Its runtime loads from the Pyodide CDN; your code stays in this browser.
Find a rule that can never fire
A rule is shadowed if an earlier rule catches everything it would match. Read a count, then that many rules as action port, where port may be *. Print the 1-based number of each shadowed rule, one per line, or none.
A rule is shadowed when an earlier rule has the same port, or an earlier rule has port *.
- A repeated port
- A clean list
- A wildcard first
Python runs in a sandboxed browser worker with a 60 second time limit. Its runtime loads from the Pyodide CDN; your code stays in this browser.
Questions about this lesson
Stuck? Ask. Figured something out? Share it. Explaining is one of the best ways to learn.
Loading posts…