← ACARA Digital Technologies Years 9–10

Firewall rule: allow or deny by IP address

A firewall rule that blocks traffic from one IP address. Use a range like 192.168.1.0/24 to match a whole network, and allow to let only trusted addresses, such as the school network, in.

Part of: ACARA Digital Technologies Years 9–10 — Networked Systems and Access Control — Module 125, WA Computer Science ATAR Year 11 — Network Communications — Module 115, WA Computer Science ATAR Year 11 — Cyber Security — Module 120

Understanding Firewall rule: allow or deny by IP address in ACARA Digital Technologies Years 9–10

What it does: An allow rule with a range matches every school device at once, so the rule is short and covers the whole network. deny blocks matching traffic. The address 192.168.1.50 matches only that one device. A firewall rule can only match real addresses, so an invalid number like 300 means the rule fails and must be fixed to a value from 0 to 255.

Common mistakes: Without /24 the rule matches only one address (192.168.1.0), not the whole school network. It should be allow from 192.168.1.0/24. 256 is not a valid number in an IPv4 address because each part must be 0 to 255. It should be allow from 10.20.0.0/16.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Firewall rule: allow or deny by IP address to a class →

This module's key terms are also in a printable crossword (Modules 116–154) and word search (Modules 116–225).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Which firewall rule blocks traffic coming from the single device at 192.168.1.50?
deny from 192.168.1.50allow from 192.168.1.50
Matches
deny from 192.168.1.0/24 (meant to block only one laptop, 192.168.1.50)
↓
The /24 range blocks the whole network, not just one device. Use deny from 192.168.1.50 to block only the laptop.
Applying
Meanings
Term
deny from 192.168.1.50
Meaning
A firewall rule that blocks traffic from one IP address. Use a range like 192.168.1.0/24 to match a whole network, and allow to let only trusted addresses, such as the school network, in.
Practice
allow from 192.168.1.0/24
Testing
Gaps
from 192.168.1.10
Check Answer
Spots
2deny from 192.168.1.50
3allow from 192.168.1.0

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Camel' badge — Endurance Champion, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which firewall rule blocks traffic coming from the single device at 192.168.1.50?
A. allow from 192.168.1.50
B. deny from 192.168.1.50 ✓
deny blocks matching traffic. The address 192.168.1.50 matches only that one device.
2. A rule says: allow from 192.168.1.0/24. What does it match?
A. Only the device 192.168.1.0
B. Every device on the 192.168.1.x network ✓
The /24 range covers the whole network, addresses 192.168.1.0 to 192.168.1.255, not just one device.
3. The school wants only its own network let in. Which approach does that?
A. Allow the school's address range and deny everything else ✓
B. Deny the school's address range and allow everything else
To let only trusted addresses in, allow the school range and block the rest. Denying the school range would lock out your own students.
4. A firewall rule can match traffic by its source IP address.
A. True ✓
B. False
Rules can match the source or destination IP address (or range), so traffic from a named device or network can be allowed or blocked.
5. Which rule is the best way to block a whole network, such as 10.0.0.0/24?
A. deny from 10.0.0.0/24 ✓
B. deny from 10.0.0.1
A range like /24 blocks every address on the network. A single address like 10.0.0.1 blocks only one device.

Match the Pairs

deny from 192.168.1.50 → Blocks all traffic coming from the single device with the address 192.168.1.50
allow from 192.168.1.0/24 → Lets in traffic from every device in the 192.168.1.x network range
To let only the school network in, write an allow rule for the school's address range → allow from 10.20.0.0/16
To block one troublesome device, write a deny rule using its single IP address → deny from 203.0.113.9
deny from 192.168.1.0/24 (meant to block only one laptop, 192.168.1.50) → The /24 range blocks the whole network, not just one device. Use deny from 192.168.1.50 to block only the laptop.
allow from 192.168.1.300 → 192.168.1.300 is not a valid IPv4 address because each number can only be 0 to 255, so the rule would not match a real device.

Key Term

deny from 192.168.1.50
A firewall rule that blocks traffic from one IP address. Use a range like 192.168.1.0/24 to match a whole network, and allow to let only trusted addresses, such as the school network, in.

Fill in the Blanks

1. # Let the teacher PC in allow from 192.168.1.10
Hint: Type the action keyword that lets traffic through.
2. # Only the school network (192.168.1.x) allow from 192.168.1.0/24
Hint: Type the address range that covers the whole school network.
3. # Block all addresses in 192.168.5.x deny from 192.168.5.0/24
Hint: Type the suffix that turns one address into a range of 256 addresses.
4. allow from 192.168.1.0/24 deny from any
Hint: Type the action that blocks everyone not allowed by the first rule.
5. # Block one laptop deny from 192.168.1.50
Hint: Type the keyword that shows the source address follows.

Spot the Error

Question 1
A # Block one laptop
B deny from 192.168.1.50
C allow from 192.168.1.0
Line C — Without /24 the rule matches only one address (192.168.1.0), not the whole school network. It should be allow from 192.168.1.0/24.
Question 2
A # Only school network gets in
B allow from 10.20.0.256/16
C deny from any
Line B — 256 is not a valid number in an IPv4 address because each part must be 0 to 255. It should be allow from 10.20.0.0/16.
Question 3
A # Block a suspicious device
B deny from 203.0.113.9
C deny from any
Line C — This blocks every address, not just the suspicious one. After denying the single address, the last rule should be allow from any so other devices can still connect.
Question 4
A # Block the guest tablet
B deny from 192.168.1.777
C allow from 192.168.1.0/24
Line B — Each part of an IPv4 address can only go up to 255, so 777 is invalid. The rule should be deny from 192.168.1.77.
Question 5
A # School firewall rules
B deny from 192.168.1.50
C allow from 192.168.1.0/24
D allow from any
Line D — The last rule should deny everything that is not the school network. Using allow from any lets all outside addresses in, so the rule should be deny from any.

Student with a class code? Join your class →