Rules & Actions

A firewall is a list of rules. Each rule = match criteria + action.

ACCEPT  src=192.168.1.0/24 dst=any port=80,443  proto=tcp
DROP    src=any            dst=internal         port=22  proto=tcp
REJECT  src=10.0.0.0/8     dst=any              port=any proto=any

Match fields:

• src IP / CIDR.
• dst IP / CIDR.
• src port / range.
• dst port / range.
• protocol (TCP, UDP, ICMP, all).
• interface (in/out).
• conntrack state.
• TCP flags.

Actions:

• ACCEPT: allow.
• DROP: silently discard (looks like packet got lost).
• REJECT: send error back (TCP RST or ICMP unreachable).
• LOG: log + continue evaluation.
• JUMP: go to another chain.
• RETURN: back to caller.

Order matters: rules evaluated top-to-bottom; first match wins.

Default policy: if no rule matches, fall back to chain's default (typically DROP for INPUT).

iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP
iptables -A INPUT -j ACCEPT          # implicit (could be policy DROP)
iptables -P INPUT DROP                # default policy

Drop vs Reject:

• DROP: attacker doesn't know if port exists or fw blocks.
• REJECT: faster connection failure for legit clients.
• Standard: DROP at edge, REJECT for known-good but disabled.

Logging:

• Log all blocked traffic? Volume can be huge under attack.
• Sample (e.g., 1 in 100).
• Forward to SIEM.

Modern firewalls: thousands of rules common. Ordering + grouping critical for performance.

Hierarchical chains:

• INPUT, OUTPUT, FORWARD (in iptables).
• Custom chains: subroutines.
• Reduces duplication.