Unit 9: Firewalls and segmentation · Lesson 1 of 6 · 20 min
Reading a ruleset
Walk web01's nftables rules top to bottom and mark every line that the exposure policy does not allow.
mission
- You are
- The analyst doing the firewall review.
- Situation
- web01's rules are in
~/firewall/rules.nftand its approved exposure policy is inpolicy.txt. Earlier units found 22 and 8443 open to the internet. - Goal
- Compare each rule with the policy and list every difference.
- Hand in
- The ports exposed without approval and the chain whose policy breaks the rules.
A firewall as a gatehouse
Read the policy
Always start with what was approved. The rules are only correct if they say the same thing.
cat policy.txt
web01 exposure policy, approved 2026-09-02
from the internet: tcp 80, tcp 443
from the office: tcp 22 (admins), udp 161 (monitoring)
everything else: drop and log
web01 never forwards traffic
Read the chain policies
Each chain has a default verdict for packets no rule matched. The input chain should drop; a server that never forwards should drop there too.
grep -n policy rules.nft
3: type filter hook input priority 0; policy drop;
14: type filter hook forward priority 0; policy accept;
17: type filter hook output priority 0; policy accept;
you should see Input drops by default, but forward accepts.
List the port rules
Every dport ... accept line opens a door, and a rule without saddr opens it to everyone.
grep -n dport rules.nft
6: tcp dport 22 accept
7: tcp dport { 80, 443 } accept
8: tcp dport 8443 accept
9: tcp dport 3389 accept
10: ip saddr 10.10.0.0/24 udp dport 161 accept
you should see 22 is open to everyone instead of the office. 8443 and 3389 are not in the policy at all.
defender tip A rule for a port with nothing listening, like 3389 here, is still a finding. The day someone installs remote desktop, it is exposed.
Reading one rule
- 1
ip saddr 10.10.0.0/24match: source in the office subnet - 2
udp dport 161match: UDP to port 161 - 3
acceptverdict when everything matched
List rules open to everyone
A port rule without saddr accepts traffic from any source.
grep -n 'dport' rules.nft | grep -v saddr
6: tcp dport 22 accept
7: tcp dport { 80, 443 } accept
8: tcp dport 8443 accept
9: tcp dport 3389 accept
you should see Four rules accept traffic from anywhere, including SSH and remote desktop.
What a defender takes away
- 1Read rules in order; the first match decides.
- 2A missing
saddrmeans the rule applies to the whole internet. - 3Compare rules with the written policy line by line, including chain policies.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.