How it works
Firewall rules describe source, destination, protocol, port, and action. The safest rule set permits required traffic and blocks unnecessary paths.
Translate rules into plain English before answering: who can talk to whom, over what service, and what is blocked.
Common error
Do not allow all traffic just because one application must be reachable.
Worked example
Evaluate a first-match rule table for a management service.
Evidence
1 ALLOW admin-subnet -> server TCP 22
2 DENY any -> server TCP 22
3 ALLOW any -> server TCP 443
4 DENY any -> any ANYAdministrator-subnet SSH is permitted by rule 1. Other SSH reaches rule 2 and is denied. HTTPS reaches rule 3 and is allowed. Rule order and all matching fields matter; a narrow exception must appear before a general deny when using first-match processing.
Exercises
3.2.1
Which rule handles a guest SSH request, and which handles a guest HTTPS request?
Show solution
Guest SSH matches rule 2 and is denied. Guest HTTPS does not match the SSH rules, so rule 3 allows it.
3.2.2
What goes wrong if rule 2 is moved above rule 1?
Show solution
The general SSH denial matches administrator SSH first, so the administrator exception is never reached. Test required access after reordering rules.