0

Someone in an interview today told me every firewall has two rules: explicit allow at the top and explicit block at the bottom. Form the way I've always understood things firewalls are normally set to explicitly block by default (or explicitly allow if changed). Is this true? If so, why?

  • It is not true. Anyone who says this has never setup a firewall themselves. – Gaius Sep 11 at 8:06
4

Someone in an interview today told me every firewall has two rules: explicit allow at the top and explicit block at the bottom. Form the way I've always understood things firewalls are normally set to explicitly block by default (or explicitly allow if changed). Is this true? If so, why?

The explicit allow would not be an allow for everything, rather just some specific things.

The explicit block at the bottom would be a block for everything (everything not allowed by the previous rules).

For example, you could start off by configuring your firewall to literally block everything:

src-ip; src-port; dest-ip; dest-port; action
1. Any; Any; Any; Any; Deny

But this firewall just blocks everything so not super useful.

Next, if you want to allow some stuff through the firewall (e.g., you want to allow any source to communicate with an explicit http server at ), then you could update your rules to:

src-ip; src-port; dest-ip; dest-port; action
1. Any; Any; <server-ip>; 80; Allow
2. Any; Any; Any; Any; Deny

So, now your firewall doesn't just block everything, it allows some http per the first rule and then blocks everything else that doesn't match that rule with the final block rule.

This may be what your interviewer was getting at with their comment about rules.

  • 1
    No, I'm pretty sure he meant what he said that an implicit allow was always at the top of the rules. I think your explanation is good and verifies what I know. sorry I should have said implicit allow and implicit deny in my post, not explicit. – Jack Sep 11 at 1:08
  • 2
    @Jack - Generally the firewall rule processing is First Match. Once a match occurs, there is no fall-thru to subsequent rules. An Allow All first rule would match everything and nothing more would happen, effectively no firewall. – user10216038 Sep 11 at 2:55
  • Hi, thank you! I thought this was the case, but I'm not a firewall expert so I wanted to be sure. the interviewer was confusing me and I didn't want to take his explanation at face value – Jack Sep 18 at 15:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.