Production Firewall

Operating firewalls in production:

Configuration management:

• Don't write rules ad-hoc. Use IaC.
• Tools: ansible-iptables, terraform-aws-security-group, fwbuilder.
• Version control all rules.

Change management:

• Test rules before deploying.
• Have rollback plan.
• Schedule changes during low traffic.
• Two-person review for production rules.

Performance:

• Linear rule scan: O(N) per packet.
• For 10k rules: noticeable latency.
• ipset (Linux): hash-based lookups for IP lists.
• nftables: more efficient rule engine (replaces iptables).
• TCAM hardware: enterprise routers do firewall in silicon.

Hardware vs software:

• Software: flexible, slower (~1-10 Gbps per box).
• Hardware (Cisco, Palo Alto, Fortinet): 10-100 Gbps. Expensive.
• Cloud (AWS Security Groups): horizontal scale, but limited rule count.

Common architectures:

Edge firewall + segmentation:

Internet → Edge FW → DMZ FW → Internal FW → Segments
                       ↓
                   Public servers

Each layer drops more aggressively.

HA pairs:

• Two firewalls, active-passive.
• VRRP for shared IP.
• Conntrack sync (replicate connection state).
• Sub-second failover.

Cloud security groups:

• AWS, GCP, Azure: define rules per VM/subnet.
• Stateful (return traffic auto-allowed).
• Quota: ~50-100 rules per group.
• Use NACLs for additional layer.

WAF (Web Application Firewall):

• L7 inspection: HTTP headers, body, cookies.
• Block SQLi, XSS, common exploits.
• Cloudflare WAF, AWS WAF, ModSecurity.

Zero trust:

• Network firewall as one layer; identity-based access at app layer.
• Beyondcorp, ZTNA tools.
• Modern direction.

Common mistakes:

• Allowing port 22 from internet.
• No egress filtering.
• Default-allow chains.
• Wildcard rules in privileged places.
• Forgetting to handle ICMP.

Don't:

• Disable firewall to "fix" connectivity (debug properly).
• Use overly broad rules.
• Skip logging.

Do:

• Default deny.
• Whitelist explicitly.
• Monitor + alert.
• Test rules in staging.