Chapter 14 — Firewalls and segmentation
Lesson map
Lesson 14 published. Map, example, EX040.
flowchart TD
N0["Learning outcomes"]
N1["14.1 Why review rules"]
N2["14.2 The firewall lab"]
N3["Lab — Reviewing a synthetic firewall rule list for b"]
N4["14.3 Interpreting"]
N5["14.4 Safe clean-up"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX040"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["14.1 Why review rules"]
N2["14.2 The firewall lab"]
N3["Lab — Reviewing a synthetic firewall rule list for b"]
N4["14.3 Interpreting"]
N5["14.4 Safe clean-up"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX040"]
[Learning outcomes]
|
v
[14.1 Why review rules]
|
v
[14.2 The firewall lab]
|
v
[Lab — Reviewing a synthetic firewall rule list for b]
|
v
[14.3 Interpreting]
|
v
[14.4 Safe clean-up]
|
v
[Worked example] --> [Exercise EX040]
Learning outcomes
You will (1) review firewall rules systematically; (2) find overly broad, shadowed and unused rules; (3) clean up rules safely.
14.1 Why review rules
Firewall rules accumulate over years as suppliers and staff request access. Old rules are rarely removed, because nobody remembers why they exist and everyone fears breaking something. Jamal is asked to review the rule list for Riverbend's head office firewall. Ms. Grant explains three common problems: rules that allow too much, rules that can never take effect because an earlier rule already matches the same traffic, and rules that have not been used for a long time. He exports the rule list with ninety days of hit counts.
14.2 The firewall lab
The lab reviews a synthetic list of twelve rules with hit counts for ninety days. Rule 11 allows any traffic from anywhere to anywhere. Because the firewall applies the first matching rule, rule 11 makes the final deny rule, rule 12, unreachable, and it has zero hits. Rule 9 duplicates rule 1 and is shadowed by it. Rules 6, 9, 10 and 12 have zero hits, including rule 6, which allows a supplier remote desktop access to the tills. He presents the findings to the IT manager in a short table listing each rule, its hits and the problem found, if any, with a proposed action for each.
Lab — Reviewing a synthetic firewall rule list for broad, shadowed and unused rules
"""Review a synthetic firewall rule list for any-any rules, shadowed rules and unused rules (stdlib only)."""
rules = [
(1, "allow", "staff", "internet", "443", 51234), (2, "allow", "staff", "internet", "80", 20877),
(3, "allow", "staff", "booking", "443", 9411), (4, "allow", "guest", "internet", "443", 40210),
(5, "deny", "guest", "staff", "any", 1876), (6, "allow", "supplier", "tills", "3389", 0),
(7, "allow", "staff", "tills", "443", 2210), (8, "allow", "cctv", "internet", "any", 1530),
(9, "allow", "staff", "internet", "443", 0), (10, "allow", "mgmt", "switches", "22", 0),
(11, "allow", "any", "any", "any", 312), (12, "deny", "any", "any", "any", 0),
]
anyany = [r[0] for r in rules if r[2] == "any" and r[3] == "any" and r[4] == "any" and r[1] == "allow"]
def shadowed(rs):
out = []
for i, r in enumerate(rs):
for p in rs[:i]:
if p[2] in ("any", r[2]) and p[3] in ("any", r[3]) and p[4] in ("any", r[4]):
out.append((r[0], p[0])); break
return out
unused = [r[0] for r in rules if r[5] == 0]
print(f"rules {len(rules)}; allow any-any: {anyany}")
print(f"shadowed (rule, by): {shadowed(rules)}")
print(f"zero hits in 90 days: {unused}")
print(f"after removing rule 11, shadowed: {shadowed([r for r in rules if r[0] != 11])}")
Run with python3 lab_firewall.py. Verified output:
rules 12; allow any-any: [11]
shadowed (rule, by): [(9, 1), (12, 11)]
zero hits in 90 days: [6, 9, 10, 12]
after removing rule 11, shadowed: [(9, 1)]
14.3 Interpreting
The any-to-any rule is the most serious finding, because it means the firewall effectively allows anything not matched earlier, and the deny rule meant to block everything else never applies. Jamal asks the IT manager about it; it was added during a network problem two years ago as a temporary fix. The unused supplier remote desktop rule is also concerning, because remote desktop to tills is a common ransomware entry route. Rule 10, for managing switches, is unused but legitimate. He records each finding's history.
14.4 Safe clean-up
Jamal proposes changes: remove rule 11, so the final deny takes effect; remove the duplicate rule 9; remove the supplier rule 6 after confirming with the supplier; and keep rule 10 with a note explaining its purpose. The lab shows that after removing rule 11, only rule 9 remains shadowed. The IT manager makes the changes during a quiet period with a rollback plan, monitors for problems for a week and records each change. The supplier confirms it no longer needs rule 6. After a week without problems, Jamal schedules a review of the rule list every six months.
Worked example
Jamal reviews twelve synthetic rules, finds an any-to-any rule making the final deny unreachable, a duplicate and an unused supplier remote desktop rule, and cleans up safely.
Synthetic case. Rules are synthetic; outputs come from lab_firewall.py.
Errors and limits
An allow-any rule above the final deny makes the deny useless.
Exercises
- EX040 — Broad rule. Which rule allows any traffic? Rubric: 3 = rule 11;; 2 = partly correct;; 1 = wrong;; 0 = none.
- EX041 — Unreachable deny. Why does rule 12 have zero hits? Rubric: 3 = rule 11 matches first;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX042 — Supplier rule. What does unused rule 6 allow? Rubric: 3 = supplier remote desktop to tills;; 2 = partly correct;; 1 = vague;; 0 = none.
Continue studying — lesson 14 (chapter 14 of 30)
← Chapter 13 · Course chapter index · Chapter 15 →
Continue to the next authored lesson.