Firewalls

Why firewalls

Without a firewall, every open port on every machine can be reached by anyone who can reach the network. A firewall is a gatekeeper between networks (or in front of one machine) that checks each connection against rules and allows or blocks it.

How rules work

A rule usually says: from this source, to this destination, on this protocol and port, do this action (allow or deny). Rules are checked from top to bottom and the first match wins. If nothing matches, a default action applies.

#  Source            Destination     Port      Action
1  10.20.0.0/16      10.50.0.10      TCP 443   ALLOW   (staff to intranet)
2  10.20.5.0/24      10.50.0.20      TCP 22    ALLOW   (IT team SSH to server)
3  any               10.50.0.0/24    any       DENY    (nothing else to servers)
*  default                                     DENY

Default deny

Default deny (also called "deny by default" or an allow-list) means everything is blocked unless a rule allows it. The opposite, default allow, blocks only what you remembered to block, and attackers find what you forgot. Default deny is the professional standard for incoming traffic and increasingly for outgoing traffic too.

Types of firewalls

Ingress and egress

Ingress filtering controls traffic coming in. Egress filtering controls traffic going out. Egress rules are often forgotten, but they matter: malware needs to call out to its controller and copy data out. A server that only needs to talk to a database should not be able to connect to any address on the internet.

Host firewall examples

$ sudo ufw default deny incoming
$ sudo ufw default allow outgoing
$ sudo ufw allow from 192.168.1.0/24 to any port 22 proto tcp
$ sudo ufw allow 443/tcp
$ sudo ufw enable
$ sudo ufw status verbose
Status: active
Default: deny (incoming), allow (outgoing), disabled (routed)

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    192.168.1.0/24
443/tcp                    ALLOW IN    Anywhere

PS> New-NetFirewallRule -DisplayName "Block inbound Telnet" -Direction Inbound -Protocol TCP -LocalPort 23 -Action Block
PS> Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction

Name    Enabled DefaultInboundAction
----    ------- --------------------
Domain     True                Block
Private    True                Block
Public     True                Block

Common mistakes

• "Any any allow" rules added during troubleshooting and never removed.
• Wrong order: a broad allow above a specific deny makes the deny useless.
• Only filtering incoming traffic. Add egress rules for servers.
• Opening management ports (SSH, RDP, admin panels) to 0.0.0.0/0, the whole internet.
• Never reviewing rules. Old rules for retired projects pile up; review them on a schedule.