Protecting Networks: Firewalls
Introduced| English | Meaning |
|---|---|
| firewall/ˈfaɪəwɔːl/ | A security system that filters network traffic according to rules. |
| stateless/ˈsteɪtləs/ | stateless |
| stateful/ˈsteɪtfl/ | stateful |
| access control list/ˈækses kənˈtrəʊl lɪst/ | access control list |
What a firewall does
- A firewall 防火墙 allows or denies traffic in or out of a network.
- Stateless 无状态 filters on packet headers alone.
- Stateful 有状态 also tracks each connection's state.
The ACL and first match
- A firewall follows an access control list (ACL) 访问控制列表.
- Rules are checked in order; the first match wins.
- So the order of rules changes which traffic gets through.
A firewall checks each packet against its rules from the top; the first match wins
Which firewall rule fires first?
A firewall checks its ACL top-to-bottom and applies the first rule that matches the packet.
In a firewall ACL, which rule is applied to a packet?
Difficulty 1/5 · 100 coins + a small bonus on first completion today
The first matching rule wins.
A firewall that tracks the state of each connection is...
Difficulty 1/5 · 100 coins + a small bonus on first completion today
Stateful firewalls track connections.
A firewall's ordered set of permit/deny rules is called an ____.
Difficulty 1/5 · 100 coins + a small bonus on first completion today
The ACL (access control list) drives the firewall.
Where firewalls belong
- At every gateway between the internal network and the internet.
- At the boundary of each network segment.
- Each firewall's security level can be set independently.
Rule order is everything. A Deny rule placed above an Allow rule for the same traffic blocks it — even though the Allow exists lower down. Read an ACL top-to-bottom and stop at the first match.
If an ALLOW rule appears below a DENY rule for the same traffic, the traffic is allowed.
Difficulty 1/5 · 100 coins + a small bonus on first completion today
False. Firewall rules are checked top-down and the first match wins, so the DENY above fires first and the traffic is blocked.
A packet is TCP 443. Order the rules by which is checked first.
Difficulty 3/5 · 200 coins + a small bonus on first completion today
Rules are checked top-down; the packet is denied at Rule 2 before reaching Rule 3.
Rule 1: ALLOW TCP 22; Rule 2: DENY TCP 22. SSH traffic hits Rule 1 first, so it is allowed. Swap them, and now Rule 1 denies it — the same two rules give opposite results just by changing the order.
A firewall permits or denies traffic using an ordered ACL, where the first matching rule wins — so rule order decides the outcome. Firewalls belong at every internet gateway and segment boundary. Stateful firewalls track connections; stateless ones only read headers.