Firewall rule: allow or deny by IP address
Name:
Date:
Class:
A
Quick Questions
Shade in the A or B circle for each question.
1. Which firewall rule blocks traffic coming from the single device at 192.168.1.50?
2. A rule says: allow from 192.168.1.0/24. What does it match?
3. The school wants only its own network let in. Which approach does that?
4. A firewall rule can match traffic by its source IP address.
5. Which rule is the best way to block a whole network, such as 10.0.0.0/24?
B
Match the Pairs
Draw a line connecting each item on the left to its match on the right.
| Left column | Right column | |
|---|---|---|
| 1deny from 192.168.1.50 | Adeny from 203.0.113.9 | |
| 2allow from 192.168.1.0/24 | BLets in traffic from every device in the 192.168.1.x network range | |
| 3To let only the school network in, write an allow rule for the school's address range | CBlocks all traffic coming from the single device with the address 192.168.1.50 | |
| 4To block one troublesome device, write a deny rule using its single IP address | Dallow from 10.20.0.0/16 | |
| 5deny from 192.168.1.0/24 (meant to block only one laptop, 192.168.1.50) | EThe /24 range blocks the whole network, not just one device. Use deny from 192.168.1.50 to block only the laptop. | |
| 6allow from 192.168.1.300 | F192.168.1.300 is not a valid IPv4 address because each number can only be 0 to 255, so the rule would not match a real device. |
C
Definitions
deny from 192.168.1.50
D
Fill in the Blanks
Complete each line of code by filling in the missing parts.
1.
# Let the teacher PC in
_____ from 192.168.1.10
2.
# Only the school network (192.168.1.x)
allow from ______________
3.
# Block all addresses in 192.168.5.x
deny from 192.168.5.0___
4.
allow from 192.168.1.0/24
____ from any
5.
# Block one laptop
deny ____ 192.168.1.50
E
Spot the Error
Shade in the letter of the line that contains an error.
Question 1
A
# Block one laptop
B
deny from 192.168.1.50
C
allow from 192.168.1.0
Question 2
A
# Only school network gets in
B
allow from 10.20.0.256/16
C
deny from any
Question 3
A
# Block a suspicious device
B
deny from 203.0.113.9
C
deny from any
Question 4
A
# Block the guest tablet
B
deny from 192.168.1.777
C
allow from 192.168.1.0/24
Question 5
A
# School firewall rules
B
deny from 192.168.1.50
C
allow from 192.168.1.0/24
D
allow from any
Answer Key
Firewall rule: allow or deny by IP address
Section A: Quick Questions
Q1
B — deny from 192.168.1.50
Q2
B — Every device on the 192.168.1.x network
Q3
A — Allow the school's address range and deny everything else
Q4
A — True
Q5
A — deny from 10.0.0.0/24
Section B: Match the Pairs
Q1
deny from 192.168.1.50 → Blocks all traffic coming from the single device with the address 192.168.1.50
Q2
allow from 192.168.1.0/24 → Lets in traffic from every device in the 192.168.1.x network range
Q3
To let only the school network in, write an allow rule for the school's address range → allow from 10.20.0.0/16
Q4
To block one troublesome device, write a deny rule using its single IP address → deny from 203.0.113.9
Q5
deny from 192.168.1.0/24 (meant to block only one laptop, 192.168.1.50) → The /24 range blocks the whole network, not just one device. Use deny from 192.168.1.50 to block only the laptop.
Q6
allow from 192.168.1.300 → 192.168.1.300 is not a valid IPv4 address because each number can only be 0 to 255, so the rule would not match a real device.
Section C: Definitions
Q1
deny from 192.168.1.50 — A firewall rule that blocks traffic from one IP address. Use a range like 192.168.1.0/24 to match a whole network, and allow to let only trusted addresses, such as the school network, in.Section D: Fill in the Blanks
Q1
# Let the teacher PC in
allow from 192.168.1.10Q2
# Only the school network (192.168.1.x)
allow from 192.168.1.0/24Q3
# Block all addresses in 192.168.5.x
deny from 192.168.5.0/24Q4
allow from 192.168.1.0/24
deny from anyQ5
# Block one laptop
deny from 192.168.1.50Section E: Spot the Error
Q1
C — Without /24 the rule matches only one address (192.168.1.0), not the whole school network. It should be allow from 192.168.1.0/24.
Q2
B — 256 is not a valid number in an IPv4 address because each part must be 0 to 255. It should be allow from 10.20.0.0/16.
Q3
C — This blocks every address, not just the suspicious one. After denying the single address, the last rule should be allow from any so other devices can still connect.
Q4
B — Each part of an IPv4 address can only go up to 255, so 777 is invalid. The rule should be deny from 192.168.1.77.
Q5
D — The last rule should deny everything that is not the school network. Using allow from any lets all outside addresses in, so the rule should be deny from any.