Firewall configuration

In short: A firewall configuration consists of rules that define which network traffic is allowed or blocked. Direction, protocol, port, address and the default rule (forbid everything that is not allowed) are decisive.

In more detail: The firewall checks each packet against the rule list in order. The first matching rule decides (allow, drop, reject). A good configuration is concise, comprehensible and follows the principle of least privilege.

In Depth

Basic principles:

• Default deny: Block everything inbound, open only what is explicitly needed. Restrict outbound depending on the environment.
• Stateful: Replies to self-initiated connections are allowed automatically.
• Order matters: Specific rules before general ones. Last rule: “deny all”.
• Minimal: Every rule has a reason, is documented and is reviewed regularly.

Components of a rule: Source (IP/network), destination, protocol (TCP/UDP/ICMP), port, direction, action, logging.

Examples:

Windows Defender Firewall (PowerShell):

New-NetFirewallRule -DisplayName "Allow HTTPS" -Direction Inbound -Protocol TCP -LocalPort 443 -Action Allow
Get-NetFirewallRule | Where Enabled -eq True

Linux (ufw):

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp          # SSH
sudo ufw allow from 192.168.1.0/24 to any port 3306   # MySQL only from the LAN
sudo ufw enable
sudo ufw status verbose

Linux (nftables, excerpt):

table inet filter {
  chain input {
    type filter hook input priority 0; policy drop;
    ct state established,related accept
    iif lo accept
    tcp dport { 22, 443 } accept
  }
}

Typical configuration tasks:

• Port forwarding (NAT/DNAT) on the router for internal servers.
• DMZ: Public servers in a separate network.
• Segmentation: Separate guest, office and server networks.
• Geo/reputation filters, rate limiting against brute force, application control.
• Logging and alerts, evaluating logs.

Typical mistakes:

• Rules too open (“any any allow”).
• Old rules nobody knows anymore.
• Services reachable from the internet that need not be (RDP 3389, databases).
• No tests: After changes check with nmap from outside or telnet host port.
• Firewall without firmware updates.
• Relying on the firewall alone. It does not replace patches, passwords and encryption.

Procedure: Collect requirements → design rules → test in a test environment → deploy with a fallback plan → document → review regularly.

See also: Firewall, NAT (network address translation), Web application firewall (WAF)