[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 3 · 3.4.d
AP Cybersecurity · Securing Networks
Configuring a Firewall
Translate the requirement clause by clause — then order specific above general.
key ideaTranslate the requirement clause by clause — then order specific above general.
The syntax
Firewall configuration is a translation exercise. The requirements say what traffic, from which sources, to which destinations, should be allowed or denied. Each clause becomes a rule, and the order of those rules is part of the configuration, not a formatting detail.
the requirement, in wordsfour clauses — each becomes at least one rule
requirement:
external users must reach the public web server on HTTPS
administrators (203.0.113.0/24) must reach it on SSH
the web server must not initiate connections to the internal network
everything else: denied
clause 1an inbound allow, broad source, one destination and serviceclause 2a narrower inbound allow — must sit above any deny that covers itclause 3an outbound restriction — direction mattersclause 4the default, stated explicitly rather than assumed
| A rule can filter by | Example | Note |
|---|
| source or destination IP | 203.0.113.0/24 | a single host or a range |
| source or destination port | tcp/443 | the service's logical port |
| service or protocol | tcp | or udp, icmp |
| application | a named application | requires a next-generation firewall |
| direction | inbound / outbound | an inbound rule does nothing to egress |
Most exam configurations use the first three. Direction is the field most often left implicit and most often wrong — state it on every rule.
Doing it step by step
1
List the requirements as separate clauses
What traffic, from which sources, to which destinations, allowed or denied. One idea per clause.
in a policy out numbered clauses
2
Write one rule per clause
Direction, source, destination, service, action. Do not merge two clauses into one clever rule.
out an unordered rule set
3
Sort specific above general
Rules execute in order, and changing the order changes which traffic is allowed. Any narrow exception must precede the broad rule it is an exception to.
out an ordered set
4
Add explicit defaults for both directions
Deny inbound ANY and deny outbound ANY at the end. A default that is written down is a decision; one that is inherited is an assumption.
out a complete configuration
5
Trace representative packets
One that should be allowed, one that should be denied, one for each direction. Name the rule number that decides each.
out evidence the configuration does what was asked
the finished configurationsix rules, ordered
# dir source destination service action
1 inbound 203.0.113.0/24 10.0.5.20 tcp/22 allow
2 inbound ANY 10.0.5.20 tcp/443 allow
3 inbound ANY ANY ANY deny
4 outbound 10.0.5.20 10.0.0.0/8 ANY deny
5 outbound 10.0.5.20 ANY tcp/443 allow
6 outbound ANY ANY ANY deny
rule 1 above rule 3specific SSH permit precedes the broad inbound denyrule 2the public service, open to all sources on one port onlyrule 3default deny inbound — stated, not inheritedrule 4 above rule 5the web server is blocked from the internal range before its general egress allowrule 6default deny outbound — the other half people forget
Worked analysis
EX 1
Translate a requirement
“Allow inbound TCP 22 from the office range only.” Write the rules and justify the order.
1
Split into clauses
An allow for the office range, and a deny for everyone else.
2
Write the allow
inbound 203.0.113.0/24 ANY tcp/22 allow.
3
Write the deny
inbound ANY ANY tcp/22 deny.
4
Order them
Allow above deny — the deny would otherwise match first and the allow would never run.
5
Trace two packets
From 203.0.113.9: rule 1, allowed. From 198.51.100.4: rule 2, denied. ✓
EX 2
The outbound half
The requirement says the web server must not initiate connections into the internal network. Why is an inbound rule insufficient?
1
Read the direction
The server initiates — that is outbound from its position.
2
Test the inbound rules
They govern traffic arriving at the server, not traffic it sends.
3
Write the correct rule
outbound 10.0.5.20 10.0.0.0/8 ANY deny.
4
Place it
Above any general outbound allow the server has, or it will never take effect.
5
State the principle
Every requirement has a direction. Filtering one way leaves the other completely open.
EX 3
Diagnose a broken change
After a change, administrators cannot reach SSH although the allow rule is still present. What happened?
1
Check the rule exists
It does — so the problem is not a deletion.
2
Check what precedes it
A broader deny tcp/22 was added above it.
3
Explain the behavior
The first matching rule executes, so the deny decides and the allow is unreachable.
4
Give the fix
Move the specific allow above the deny — no rule text needs to change.
5
Note the review habit
Ask what moved, not only what was added. Reordering is a functional change.
Verify the result
four checks
- For each requirement clause, name the rule number that implements it.
- For each rule, name a packet it decides that no earlier rule already decided.
- Confirm both inbound and outbound defaults are written explicitly.
- Re-trace after any reorder — changing the order changes the behavior.
Check yourself
What do firewall requirements specify?
Show answer
What type of traffic, from which sources or to which destinations, should be allowed or denied.
On what can a specific firewall rule filter?
Show answer
Source or destination port or IP address, service, protocol, or application — and inbound or outbound direction.
Why does rule order matter?
Show answer
Rules are implemented in order, so changing the order of a set of rules changes which traffic is allowed or denied. Precedence must be considered when establishing the order.
An allow rule is present but the traffic is blocked. What is the likely cause?
Show answer
A broader deny rule sits above it, so the deny matches first and the allow is never evaluated. Move the specific rule above the general one.