Designing firewall rule sets: zones, default deny, rule order and egress

Skills you'll practise

• Place systems in zones (including a DMZ for public services) and state what each zone may reach
• Explain deny by default and stateful filtering, and what they mean for return traffic
• Identify shadowed and over-broad rules in a first-match rule set and reorder or narrow them
• Write outbound (egress) rules that limit what internal systems can reach
• Use firewall log entries to find which rule matched a connection and decide on a fix

Course outline

1. 1.Firewall rule sets that do what you meanVideo · 3 min
2. 2.Zones, deny by default and stateLesson · 16 min
3. 3.Rule order, shadowed rules and egressLesson · 17 min
4. 4.Port forwards, logs and troubleshootingLesson · 16 min
5. 5.Designing firewall rule sets: zones, default deny, rule order and egress: knowledge checkKnowledge check · 17 questions
6. 6.Final exam10 questions · passing it completes the course, so people who already know the material can test out

Sources it draws on

The lessons and questions are written from these references, so learners can go back to the original.

• NIST SP 800-41 Rev. 1: Guidelines on Firewalls and Firewall Policy (2009)
• Netgate docs: pfSense firewall fundamentals (first-match evaluation, stateful filtering)
• Netgate docs: pfSense firewall rule best practices (default deny, keep it short, review, document)