Overview
A firewall's behavior comes down to its rules — ordered statements that allow or deny traffic. Two principles dominate good rule design: default deny and least privilege. This lesson explains how allow/deny rules work and how to reason about them.
Learning objectives
- Explain how firewall rules are structured and evaluated.
- Apply the default-deny principle.
- Understand rule order and specificity.
Core concept
A firewall rule typically specifies: a match (source, destination, port, protocol) and an action (allow or deny). Rules are evaluated in order, and a common model applies the first matching rule. Two guiding principles:
- Default deny — anything not explicitly allowed is blocked. The safe default: start closed, open only what is needed.
- Least privilege — permit the minimum necessary (specific hosts, ports, directions), not broad ranges.
How it works
Traffic is compared against the rule list top to bottom; the first rule that matches decides its fate, and if none matches, the default policy (ideally deny) applies. Because the first match wins, rule order matters: a broad allow placed above a specific deny can unintentionally permit traffic you meant to block. Well-ordered rule sets put specific rules before general ones and end with an explicit default-deny to make the policy unambiguous.
Practical example
A policy for a web server might read:
- Allow TCP to server on port 443 (HTTPS) from anywhere.
- Allow TCP to server on port 22 (SSH) from the admin network only.
- Deny all other traffic (default deny).
This exposes only HTTPS to the world and SSH only to admins; everything else is dropped. If rule 3's default-deny were missing, unintended traffic might slip through.
Cybersecurity relevance
Rule design directly determines exposure. Default deny + least privilege minimizes attack surface — the fewer things allowed, the fewer ways in. Overly broad rules ("allow all from any") are a frequent, serious finding. Testers probe for permissive rules and ordering mistakes; defenders audit rule sets to remove unneeded allowances and ensure the implicit or explicit final action is deny.
Common mistakes
- Default allow instead of default deny — leaving everything open unless blocked.
- Bad rule order — a broad allow above a specific deny negates the deny.
- Overly broad rules — allowing wide ranges or "any" when a specific host/port would do.
Key takeaways
- Firewall rules match on source/destination/port/protocol and take an allow or deny action, evaluated in order (first match wins).
- Follow default deny (block anything not explicitly allowed) and least privilege (permit the minimum needed).
- Rule order and specificity are critical; broad or misordered rules create exposure.
Check your understanding
- Why does rule order matter when the firewall applies the first matching rule?
- What do the default-deny and least-privilege principles each contribute to a secure rule set?