How a firewall decides

A firewall checks each piece of traffic against its list of rules, from the top down. The first rule that matches wins, and the firewall stops looking. If no rule matches, the default policy decides: deny all blocks it, and allow all lets it through.

Each rule says what to do (allow or deny), and what traffic it applies to: the protocol (TCP, UDP, or ICMP, which is used by ping), the port (which service, such as 443 for secure websites or 22 for SSH), and the source (who the traffic comes from).

Everything runs in your browser. Nothing you enter is sent anywhere. Your rules are saved in this browser, so you can come back to them.

1. Default policy

2. Rules

Port: any, one port such as 443, a list such as 80,443, or a range such as 1-1024. Ports don't apply to ICMP.

Source: any, one address such as 198.51.100.7, or a network such as 192.168.1.0/24.

Your rules, checked from the top down. The first rule that matches wins.
#ActionProtocolPortSourceDescriptionMove or delete

3. Test traffic

The office network in these examples is 192.168.1.0/24. Everything else comes from the internet.

Add your own test traffic:

Add some rules, then select Test all traffic.
Test traffic, and what the firewall decided
TrafficSourceProtocolPortDecisionWhyRemove