Firewalls
Firewall Rules Explained With Real Examples
A firewall is only as good as its rules. Let's write some — and understand exactly what they're doing.
I used to think of a firewall as a magic box that "blocks bad stuff." Then I had to actually configure one. Turns out, a firewall does exactly what you tell it to — nothing more. And if your rules are wrong, your firewall might be doing almost nothing at all.
How firewalls make decisions
A firewall inspects network traffic and applies rules to decide what to allow and what to block. Every rule has the same basic structure:
ACTION | PROTOCOL | SOURCE | DESTINATION | PORT
-------+----------+--------+-------------+-----
ALLOW | TCP | ANY | 10.0.0.5 | 443
DENY | TCP | ANY | ANY | 23
ALLOW | UDP | ANY | ANY | 53
Rules are processed top to bottom. The first rule that matches a packet wins — the rest are ignored. This is called first-match wins and it's the source of many firewall misconfigurations.
Stateless vs stateful — a critical difference
A stateless firewall evaluates every packet in isolation. It has no memory. This means it can't tell the difference between a packet that belongs to an established connection and a brand new unsolicited connection.
A stateful firewall tracks the state of connections. If your browser opened a TCP connection to port 443 outbound, the firewall knows that inbound reply packets belong to that session — and allows them automatically, without needing an explicit inbound rule. Almost every modern firewall is stateful.
iptables — the Linux firewall
iptables is the built-in firewall on Linux. It has three main chains: INPUT (traffic coming into your machine), OUTPUT (traffic leaving your machine), and FORWARD (traffic passing through your machine, like a router).
# View all current rules
sudo iptables -L -v -n
# Allow SSH from a specific IP only
sudo iptables -A INPUT -p tcp --dport 22 -s 192.168.1.50 -j ACCEPT
# Block all other SSH attempts
sudo iptables -A INPUT -p tcp --dport 22 -j DROP
# Allow established connections (replies to outbound)
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow HTTP and HTTPS outbound
sudo iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT
# Default deny everything else on INPUT
sudo iptables -P INPUT DROP
A common mistake — rule order
Suppose you want to block all traffic from an IP, but allow SSH from your office. If you write the rules like this:
# Wrong order — the DENY fires first, SSH never reaches the ALLOW
DENY TCP 203.0.113.10 ANY ANY
ALLOW TCP 203.0.113.10 ME 22
The block rule fires first and drops the packet before it ever reaches the SSH allow rule. Always put more specific rules before broader ones.
What "default deny" means — and why it matters
The gold standard of firewall configuration is default deny: block everything, then explicitly allow only what you need. This is the opposite of most people's instinct (allow everything, block the bad stuff) — but it's far more secure. You can't block what you don't know is bad. You can, however, only allow what you know is good.
💡 Real-world tip Before applying a default-deny policy on a remote server, always make sure your SSH allow rule is in place first. Otherwise you'll lock yourself out permanently and need console access to recover it.
What a next-generation firewall adds
Traditional firewalls work at Layers 3–4 (IP and port). A next-generation firewall (NGFW) inspects traffic all the way up to Layer 7 — the application layer. This means it can block specific apps (ban TikTok but allow YouTube), detect malware in allowed traffic, and apply rules based on user identity rather than just IP address. Tools like Cisco FTD, Palo Alto, and Fortinet operate at this level.
What to explore next:
- TryHackMe: Firewalls room (free)
- Linux Journey: Networking section
- Next post: How MITM Attacks Work — and How to Stop Them →
