← ACARA Digital Technologies Years 9–10

Firewall rule order and default deny

A firewall checks rules from the top and uses the first match. A final default deny rule blocks anything not allowed by an earlier rule.

Part of: ACARA Digital Technologies Years 9–10 — Networked Systems and Access Control — Module 126, WA Computer Science ATAR Year 11 — Network Communications — Module 116, WA Computer Science ATAR Year 11 — Cyber Security — Module 121

Understanding Firewall rule order and default deny in ACARA Digital Technologies Years 9–10

What it does: The list allows only web traffic on ports 80 and 443, then DENY ALL at the end blocks everything else. This is default deny. Device 10.0.0.9 matches Rule 1 first and is blocked. Because the first match wins, Rule 2 is never checked for that device. Default allow lets through anything that is not specifically blocked. That is why it is riskier than default deny. Firewalls apply the first match, so a broad allow placed above a specific deny makes the deny useless. The specific deny must come first.

Common mistakes: The firewall uses the first matching rule. ALLOW all on line 2 matches every packet straight away, so telnet is never blocked. Line 2 should be DENY port 23. DENY all matches every packet, and it is on line 1, so it is the first match every time. The two ALLOW rules are never reached and all traffic is blocked. Line 1 should be ALLOW port 443, with DENY all last.

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Firewall rule order and default deny to a class →

This module's key terms are also in a printable crossword (Modules 116–154) and word search (Modules 116–225).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

A firewall checks its rules in which order?

From the bottom rule up, or in a random orderFrom the top rule down, one at a time

Matches

1 ALLOW ALL 2 DENY IP 10.0.0.9

↓

The rule is in the wrong order. ALLOW ALL matches every device first, so the deny rule is never reached and 10.0.0.9 is still allowed. Move the deny rule above it.

Applying

Meanings

Term

default deny

Meaning

A firewall checks rules from the top and uses the first match. A final default deny rule blocks anything not allowed by an earlier rule.

Practice

1 ALLOW port 443

Testing

Gaps

FOR each rule FROM TO bottom

Check Answer

Spots

1# Block telnet, allow web

2ALLOW all

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A firewall checks its rules in which order?

A. From the bottom rule up, or in a random order

B. From the top rule down, one at a time ✓

A firewall reads its rules from the top down. Order matters because the first rule that matches decides what happens.

2. Traffic matches rule 2 (allow) and also rule 5 (deny). What happens to it?

A. It is allowed, because rule 2 matched first ✓

B. It is denied, because deny always beats allow

The first matching rule wins. Once rule 2 matches, the firewall stops checking and never reaches rule 5.

3. What does a default deny rule at the end of a rule list do?

A. Blocks any traffic that no earlier rule allowed ✓

B. Blocks all traffic, even traffic allowed by earlier rules

Default deny sits last. Traffic allowed by an earlier rule never reaches it, so it only blocks what was not explicitly allowed.

4. Which approach is safer for a school network firewall?

A. Default deny: block everything except what is allowed ✓

B. Default allow: allow everything except what is blocked

With default deny, a new or unknown type of traffic is blocked automatically. With default allow, you must predict every threat and write a rule for it.

5. A firewall has these rules in order: 1. Deny all traffic. 2. Allow port 443 (HTTPS). What happens to web traffic on port 443?

A. It is allowed, because rule 2 is more specific

B. It is blocked, because rule 1 matches first ✓

This is a rule in the wrong order. Deny all matches everything, so rule 2 is never reached. The specific allow rule must come before the deny all rule.

Match the Pairs

Rule 3: DENY ALL → A default deny rule at the end of the list that blocks any traffic not allowed by an earlier rule

Rule 1: ALLOW port 443 → The firewall checks this rule first, and if traffic uses port 443 it is allowed and no later rules are checked

Default deny: put a catch-all block rule last so only explicitly allowed traffic gets through → 1 ALLOW port 80 2 ALLOW port 443 3 DENY ALL

First matching rule wins: a specific deny placed above a broad allow will block that traffic → 1 DENY IP 10.0.0.9 2 ALLOW ALL

1 ALLOW ALL 2 DENY IP 10.0.0.9 → The rule is in the wrong order. ALLOW ALL matches every device first, so the deny rule is never reached and 10.0.0.9 is still allowed. Move the deny rule above it.

1 ALLOW port 80 2 ALLOW port 443 → There is no default deny rule at the end. Traffic on other ports does not match any rule, so it may be let through by default. Add 3 DENY ALL.

Key Term

default deny

A firewall checks rules from the top and uses the first match. A final default deny rule blocks anything not allowed by an earlier rule.

Fill in the Blanks

1. FOR each rule FROM top TO bottom IF packet matches: apply and stop

Hint: Type the position in the rule list where the firewall starts checking.

2. 1 ALLOW port 443 2 DENY all # Blocks anything not allowed above

Hint: Type the word that makes the final rule match every packet.

3. 1 DENY port 80 2 ALLOW port 80 Port 80 packet result: DENY

Hint: Type the action of the first rule that matches this packet.

4. 1 DENY port 23 2 ALLOW all # Default rule lets unlisted traffic in

Hint: Type the action that makes this a default-allow rule.

5. 1 DENY all 2 ALLOW port 443 # Rule 2 is never reached

Hint: Type the number of the rule hidden by the catch-all rule above it.

Spot the Error

Question 1

A # Block telnet, allow web

B ALLOW all

C ALLOW port 443

D DENY all

Line B — The firewall uses the first matching rule. ALLOW all on line 2 matches every packet straight away, so telnet is never blocked. Line 2 should be DENY port 23.

Question 2

A DENY all

B ALLOW port 53

C DENY all

Line A — DENY all matches every packet, and it is on line 1, so it is the first match every time. The two ALLOW rules are never reached and all traffic is blocked. Line 1 should be ALLOW port 443, with DENY all last.

Question 3

A # Check rules top to bottom

B ALLOW port 443

C ALLOW all

Line C — The last rule should be a default deny so anything not allowed earlier is blocked. ALLOW all is default allow, which lets unknown traffic in. Line 3 should be DENY all.

Question 4

A # Web only, block 10.0.0.9

B DENY ip 10.0.0.9

C ALLOW port 443

D DENY port 80

E DENY all

Line D — The program is meant to allow web traffic. DENY port 80 blocks normal HTTP, so port 80 would never reach DENY all as an allowed port. Line 4 should be ALLOW port 80.

Question 5

A # Block PC 10.0.0.9

B ALLOW ip 10.0.0.9

C ALLOW ip 10.0.0.0/24

D DENY all

Line B — The comment says PC 10.0.0.9 must be blocked. An ALLOW rule for that address is the first match, so the PC gets in. Line 2 should be DENY ip 10.0.0.9.

Student with a class code? Join your class →