Example Firewall Rules
A made-up company has a web server at 10.0.0.10 and an internal server at 10.0.0.20. The staff network is 10.0.1.0/24. Rules are checked from the top down and the first match wins.
| Rule | Action | Source | Destination | Port | Note |
|---|---|---|---|---|---|
| 1 | Allow | Any | 10.0.0.10 | TCP 80, 443 | Public website |
| 2 | Allow | Any | Any | Any | Added while troubleshooting |
| 3 | Allow | 10.0.1.0/24 | 10.0.0.20 | TCP 22 | Staff SSH to internal server |
| 4 | Deny | Any | Any | Any | Default deny |
The problem (try it yourself first)
- Rule 2 allows everything from everywhere, and because it comes before rules 3 and 4, those rules never get used
- The result is that the firewall allows all traffic, including SSH to the internal server from the internet
- "Temporary" troubleshooting rules are a common real-world cause of this. The fix is to remove rule 2 and keep the default deny at the bottom