How it works
Once a network is divided, something has to carry traffic between the parts, and something has to decide which traffic is allowed to make that crossing.
Read rule tables in order and against the specific traffic in the scenario. What matters is which rule matches first, not which rule sounds strictest.
Common error
A rule that is never reached has no effect. Order is part of the meaning of a rule set.
Worked example
Apply the first matching firewall rule to a student request.
Evidence
1 ALLOW staff -> grade-server TCP 443
2 DENY student -> grade-server ANY
3 ALLOW student -> internet TCP 443
4 DENY any -> any ANYA student connection to the grade server matches rule 2 and is denied. A student HTTPS connection to an unrelated public site can match rule 3. The same destination address, source group, protocol, and port must be considered together.
Exercises
3.5.1
What happens to a staff HTTPS request to the grade server and a staff SSH request to it?
Show solution
HTTPS matches rule 1 and is allowed. SSH is not covered by rule 1, and the later student rules do not match staff, so it falls to rule 4 and is denied.
3.5.2
An ALLOW any -> any rule is inserted first. Explain its effect on later deny rules.
Show solution
Under first-match processing, every connection matches the new first rule. Later deny rules become unreachable for that traffic, defeating the intended restrictions.