SimulatorUnit 3 · Topic 3.4
Firewall rules: first match wins
Order firewall rules and test packets: the first match wins.
New to this? Read the topic first: 3.4 Protecting Networks.
Simulation · Firewall rule order [3.4.B.2, 3.4.D.3]
Simulator: first match wins
You manage the firewall in front of the school web server (10.0.1.20). Test the queued traffic against the policy, then change the rule order and test again.
| Rule number | Action | Source | Destination | Direction | Port number | Protocol | Hits | Move |
|---|---|---|---|---|---|---|---|---|
| Deny | 198.51.100.0/24 | 10.0.1.20 | Inbound | 443 | HTTPS | 0 | ||
| Allow | ALL | 10.0.1.20 | Inbound | 443 | HTTPS | 0 | ||
| Allow | 10.0.5.0/24 | 10.0.1.20 | Inbound | 3389 | RDP | 0 | ||
| Deny | ALL | ALL | Inbound | ALL | ALL | 0 |
| Time | Source | Port | Action | Matched rule | Note |
|---|---|---|---|---|---|
| 08:14:02 | 192.0.2.20 | 443/HTTPS | Allow | 2 | student at home opening the school site |
| 08:14:05 | 198.51.100.7 | 443/HTTPS | Deny | 1 | server in the known bad range |
| 08:14:09 | 10.0.5.12 | 3389/RDP | Allow | 3 | network admin, remote desktop |
| 08:14:11 | 192.0.2.45 | 3389/RDP | Deny | 4 | stranger trying remote desktop |
| Time | Interface (in) | Source | Destination | Port number | Protocol | Action | Rule number |
|---|---|---|---|---|---|---|---|
| 08:14:02 | outside | 192.0.2.20 | 10.0.1.20 | 443 | HTTPS | Allow | 2 |
| 08:14:05 | outside | 198.51.100.7 | 10.0.1.20 | 443 | HTTPS | Deny | 1 |
| 08:14:09 | mgmt | 10.0.5.12 | 10.0.1.20 | 3389 | RDP | Allow | 3 |
| 08:14:11 | outside | 192.0.2.45 | 10.0.1.20 | 3389 | RDP | Deny | 4 |
| No entries yet. Run Test traffic on the Policy tab. | |||||||
| Interface | Faces | IP address | Status | In (ingress) | Dropped | Out (egress) |
|---|---|---|---|---|---|---|
| outside | Internet | 203.0.113.2/30 | Up | 3 | 2 | 0 |
| inside | School LAN (web server 10.0.1.20) | 10.0.1.1/24 | Up | 0 | 0 | 2 |
| mgmt | Admin network | 10.0.5.1/24 | Up | 1 | 0 | 0 |
Connections from the internet enter on outside; the admin's remote desktop enters on mgmt. Allowed connections leave on inside toward the web server. Denied ones are dropped where they entered and never reach the LAN.
HTTPS: Hypertext Transfer Protocol Secure. RDP: remote desktop protocol. mgmt: management. 198.51.100.0/24 covers 198.51.100.0 to 198.51.100.255.
Walkthrough: what happens if rules 1 and 2 are swapped?
With "Allow port 443 from ALL" first, the connection from 198.51.100.7 matches it immediately and is allowed. The deny rule for the bad range is never reached. Specific rules must come before broad ones [3.4.D.3].
Go to the topic: 3.4 Protecting Networks