A list of rules decides who gets in
A firewall rule is an instruction that says what to do with traffic that matches it: allow it or deny it. A firewall holds a list of these rules and reads them from the top.
The order of the list, and what happens when nothing matches, decide whether a network is safe.
A shop puts a firewall in front of its till server. The rules say who may talk to it and who may not.
By the end of this lesson
Note
I can write and read firewall rules.
Key words
| Word | What it means |
|---|---|
| Rule | a test on a packet and an action to take |
| Allow | let the packet through |
| Deny | stop the packet and let it go no further |
| First match | the first rule that fits decides, and the rest are ignored |
| Default policy | what happens to a packet no rule matches |
| Connection tracking | remembering open connections so replies are let back in |
The cells students fill in are left blank in this preview.
A rule is a test and an action
Each rule tests some facts about a packet: which protocol, which port and which address it came from. If all the facts fit, the rule applies and does its action.
Most firewalls read the rules in order, from the top. They stop at the first rule that fits.
Worked example: rules for a till server
| Rule | Action | Protocol | Port | Source |
|---|---|---|---|---|
| 1 | Allow | TCP | 443 | Any address |
| 2 | Allow | TCP | 22 | 10.0.0.0/24 (the office) |
| 3 | Deny | TCP | Any port | Any address |
The cells students fill in are left blank in this preview.
Worked example: three packets meet the list
| Packet | Rule it meets first | Result |
|---|---|---|
| TCP port 443 from 198.51.100.9 | Rule 1 | Allow |
| TCP port 22 from 10.0.0.7 | Rule 2 | Allow |
| TCP port 22 from 198.51.100.9 | Rule 3 | Deny |
The cells students fill in are left blank in this preview.
The order of the rules changes the result
Because the first match wins, a wide rule high in the list hides every rule below it.
Put a "deny everything" rule on top and nothing below it is ever read. Put "allow everything" on top and the careful denies below are dead.
The safe habit is narrow rules first, wide rules last.
Worked example: the same rules in two orders
| Packet | Allow port 22 first, then deny all | Deny all first, then allow port 22 |
|---|---|---|
| TCP port 22 | Allow | Deny |
| TCP port 80 | Deny | Deny |
The cells students fill in are left blank in this preview.
List the gateway's firewall tables
sudo ip netns exec gw nft list tablesShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Read the gateway's forward chain
sudo ip netns exec gw nft list chain inet filter forwardShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Reading the gateway's own rules
The gateway runs a firewall called nftables. A chain is a list of rules. The forward chain judges packets that pass through the gateway.
In its starting state the chain says policy drop, then two rules. The first accepts packets of connections already known (established,related). The second accepts packets that arrive from the LAN side.
Anything else falls to the policy and is dropped.
The default policy decides what no rule covers
A packet that meets no rule gets the default policy. There are two choices.
Default deny drops everything you did not allow. You list what is needed, and the rest is shut. Default allow lets in everything you did not forbid, so you must remember every danger.
Default deny is safer. A rule you forgot to write leaves a door shut, not open.
Check a rule without loading it
echo 'table inet scratch { chain c { type filter hook input priority 0; policy drop; ip saddr 10.0.0.0/24 tcp dport 22 accept; } }' | sudo ip netns exec gw nft -c -f -Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
A dry run changes nothing
The flag -c means check only. nftables reads the table and tells you if it is wrong, but it loads nothing into the gateway.
This one is valid, so the command prints nothing. A mistake in a rule would print an error that points at the word.
The table says: drop everything coming in, except TCP port 22 from the 10.0.0.0/24 network. Dry runs let you test a rule before it can lock you out.
A common mistake
Warning
Many people think the order of firewall rules does not matter, because all the rules are checked. Only the first rule that fits is used. A wide rule above a narrow one makes the narrow one useless. Put the narrow rules first.
Going further: shadowed rules
A rule is shadowed when an earlier rule always catches its packets first, so it never runs.
Write a list of four rules for a web server. Put one rule in the wrong place on purpose. Then swap with a partner and find the rule that can never run.