Firewall rule order and default deny

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A firewall checks its rules in which order?

A From the bottom rule up, or in a random order

B From the top rule down, one at a time

2. Traffic matches rule 2 (allow) and also rule 5 (deny). What happens to it?

A It is allowed, because rule 2 matched first

B It is denied, because deny always beats allow

3. What does a default deny rule at the end of a rule list do?

A Blocks any traffic that no earlier rule allowed

B Blocks all traffic, even traffic allowed by earlier rules

4. Which approach is safer for a school network firewall?

A Default deny: block everything except what is allowed

B Default allow: allow everything except what is blocked

5. A firewall has these rules in order: 1. Deny all traffic. 2. Allow port 443 (HTTPS). What happens to web traffic on port 443?

A It is allowed, because rule 2 is more specific

B It is blocked, because rule 1 matches first

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Rule 3: DENY ALL		AThere is no default deny rule at the end. Traffic on other ports does not match any rule, so it may be let through by default. Add 3 DENY ALL.
2Rule 1: ALLOW port 443		B1 ALLOW port 80 2 ALLOW port 443 3 DENY ALL
3Default deny: put a catch-all block rule last so only explicitly allowed traffic gets through		CA default deny rule at the end of the list that blocks any traffic not allowed by an earlier rule
4First matching rule wins: a specific deny placed above a broad allow will block that traffic		DThe firewall checks this rule first, and if traffic uses port 443 it is allowed and no later rules are checked
51 ALLOW ALL 2 DENY IP 10.0.0.9		EThe rule is in the wrong order. ALLOW ALL matches every device first, so the deny rule is never reached and 10.0.0.9 is still allowed. Move the deny rule above it.
61 ALLOW port 80 2 ALLOW port 443		F1 DENY IP 10.0.0.9 2 ALLOW ALL

Definitions

default deny

Fill in the Blanks

Complete each line of code by filling in the missing parts.

FOR each rule FROM ___ TO bottom IF packet matches: apply and stop

1 ALLOW port 443 2 DENY ___ # Blocks anything not allowed above

1 DENY port 80 2 ALLOW port 80 Port 80 packet result: ____

1 DENY port 23 2 _____ all # Default rule lets unlisted traffic in

1 DENY all 2 ALLOW port 443 # Rule _ is never reached

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A # Block telnet, allow web

B ALLOW all

C ALLOW port 443

D DENY all

Question 2

A DENY all

B ALLOW port 53

C DENY all

Question 3

A # Check rules top to bottom

B ALLOW port 443

C ALLOW all

Question 4

A # Web only, block 10.0.0.9

B DENY ip 10.0.0.9

C ALLOW port 443

D DENY port 80

E DENY all

Question 5

A # Block PC 10.0.0.9

B ALLOW ip 10.0.0.9

C ALLOW ip 10.0.0.0/24

D DENY all

Answer Key

Firewall rule order and default deny

Section A: Quick Questions

B — From the top rule down, one at a time

A — It is allowed, because rule 2 matched first

A — Blocks any traffic that no earlier rule allowed

A — Default deny: block everything except what is allowed

B — It is blocked, because rule 1 matches first

Section B: Match the Pairs

Rule 3: DENY ALL → A default deny rule at the end of the list that blocks any traffic not allowed by an earlier rule

Rule 1: ALLOW port 443 → The firewall checks this rule first, and if traffic uses port 443 it is allowed and no later rules are checked

Default deny: put a catch-all block rule last so only explicitly allowed traffic gets through → 1 ALLOW port 80 2 ALLOW port 443 3 DENY ALL

First matching rule wins: a specific deny placed above a broad allow will block that traffic → 1 DENY IP 10.0.0.9 2 ALLOW ALL

1 ALLOW ALL 2 DENY IP 10.0.0.9 → The rule is in the wrong order. ALLOW ALL matches every device first, so the deny rule is never reached and 10.0.0.9 is still allowed. Move the deny rule above it.

1 ALLOW port 80 2 ALLOW port 443 → There is no default deny rule at the end. Traffic on other ports does not match any rule, so it may be let through by default. Add 3 DENY ALL.

Section C: Definitions

default deny — A firewall checks rules from the top and uses the first match. A final default deny rule blocks anything not allowed by an earlier rule.

Section D: Fill in the Blanks

FOR each rule FROM top TO bottom
  IF packet matches: apply and stop

1 ALLOW port 443
2 DENY all
# Blocks anything not allowed above

1 DENY port 80
2 ALLOW port 80
Port 80 packet result: DENY

1 DENY port 23
2 ALLOW all
# Default rule lets unlisted traffic in

1 DENY all
2 ALLOW port 443
# Rule 2 is never reached

Section E: Spot the Error

B — The firewall uses the first matching rule. ALLOW all on line 2 matches every packet straight away, so telnet is never blocked. Line 2 should be DENY port 23.

A — DENY all matches every packet, and it is on line 1, so it is the first match every time. The two ALLOW rules are never reached and all traffic is blocked. Line 1 should be ALLOW port 443, with DENY all last.

C — The last rule should be a default deny so anything not allowed earlier is blocked. ALLOW all is default allow, which lets unknown traffic in. Line 3 should be DENY all.

D — The program is meant to allow web traffic. DENY port 80 blocks normal HTTP, so port 80 would never reach DENY all as an allowed port. Line 4 should be ALLOW port 80.

B — The comment says PC 10.0.0.9 must be blocked. An ALLOW rule for that address is the first match, so the PC gets in. Line 2 should be DENY ip 10.0.0.9.