HackBlue

Labs / Network defense

Firewall rule order simulator

Reorder and disable rules on a first-match firewall until every test packet gets the verdict the policy asks for, and see which rule decided each one.

  • Interactive lab
  • Beginner
  • 4 steps
  • 0 of 4 solved

Goal

The perimeter firewall checks rules top to bottom and stops at the first match. Anything that matches no rule is dropped by the default deny.

The policy: anyone may reach the web server on 80 and 443, only the admin network may use SSH, only the web server may reach the database, and the abusive range is blocked everywhere. Three test packets get the wrong verdict today.

Rules, evaluated top to bottom
  1. allow
    webtcp any → 10.0.1.10/32 port 80,443Public web traffic
  2. allow
    ssh-anytcp any → any port 22Temporary SSH rule from a migration
  3. deny
    blocklistany 198.51.100.0/24 → anyKnown abusive range
  4. allow
    ssh-admintcp 10.0.9.0/24 → 10.0.1.10/32 port 22SSH from the admin network
  5. allow
    app-dbtcp 10.0.1.10/32 → 10.0.2.20/32 port 5432Web app to its database
  6. allow
    db-anytcp any → 10.0.2.0/24 port 5432Database subnet, added during an outage
  7. deny
    default denyany any → any
Test packets3 wrong
PacketFlowPolicy wantsFirewall saysDecided by
p1Visitor loads the site over HTTPStcp 203.0.113.5 → 10.0.1.10:443allowallowweb
p2Visitor hits plain HTTP (redirected to HTTPS)tcp 203.0.113.9 → 10.0.1.10:80allowallowweb
p3Internet host tries SSH on the web servertcp 203.0.113.5 → 10.0.1.10:22denyallow ✕ssh-any
p4Admin workstation opens SSHtcp 10.0.9.14 → 10.0.1.10:22allowallowssh-any
p5Blocklisted host requests the sitetcp 198.51.100.77 → 10.0.1.10:443denyallow ✕web
p6Web app queries the databasetcp 10.0.1.10 → 10.0.2.20:5432allowallowapp-db
p7Internet host connects to the databasetcp 203.0.113.5 → 10.0.2.20:5432denyallow ✕db-any
p8Internet host sends an SNMP queryudp 203.0.113.5 → 10.0.1.10:161denydenydefault deny

Steps

  1. 01Reorder and disable rules until all eight test packets get the verdict the policy asks for.

    Do this in the workbench above. This step completes itself when the condition is met.

  2. 02Before any change, which rule lets the blocklisted host reach the site?

  3. 03Which rule has to go so that internet hosts cannot open SSH?

  4. 04Packet p8 (UDP 161) matches no rule at all. What decides it?