Read the scenario first
Each lab starts with a situation, the way a ticket or an exam question does. Work out what is being asked before you type anything.
Free tool · No sign-up needed
Firewall Rules Lab: Fix the Rule Order
A firewall has the right idea and the wrong order. Find the shadowed rules, narrow the one that is too wide and add the one that is missing.
Last updated
Firewall rules · Intermediate · About 10 minutes
The scenario
An office firewall separates three networks from the internet: the staff LAN, a guest Wi-Fi network and a DMZ with the mail server. Since a change last week, guests can open file shares on the staff LAN, mail from outside has stopped arriving, and staff can’t read their mail.
The rules are mostly there. The problems are their order, one rule that allows far too much, and one that was never written. Remember that the first matching rule decides, so a rule below a wider one never gets a say.
A simulated firewall that runs in your browser. Your rules are tested with the packets the scenario describes.
Office firewall, between the internet, the staff LAN, the guest Wi-Fi and the DMZ
- Internet (any outside address)
- Staff LAN 192.168.10.0/24
- HR file server 192.168.10.30, on the staff LAN
- Guest Wi-Fi 192.168.50.0/24
- DMZ 172.16.0.0/24
- Mail server 172.16.0.25, in the DMZ
#ActionProtocolSourceDestinationPort
- Rule 1
- Rule 2
- Rule 3
- Rule 4
- Rule 5
- 6 · Implicit deny: anything no rule above matches is blocked.
What the firewall must do
- Guests can browse the web over HTTPS.
- Guests can’t open file shares on the staff LAN.
- Guests can’t reach the HR file server.
- Guests can’t reach the mail server’s mailboxes.
- Staff can browse the web over HTTPS.
- Mail servers on the internet can deliver mail to the mail server (SMTP).
- The internet can’t open Remote Desktop on the mail server.
- Staff can read their mail on the mail server (IMAPS).
- The internet can’t reach the staff LAN.
Take it further in OpenpassAI
More labs for the certification you’re studying
OpenpassAI’s Hands-on Labs put you in a Linux or Windows terminal for the certification you’re studying, in guided, hint-only and timed modes.
About this lab
What you’ll practice, and where it’s tested
What you’ll practice
- Spotting a shadowed rule
- Putting specific rules above general ones
- Narrowing an over-permissive rule
- Testing a change against every requirement
Exams it helps with
- CompTIA Security+Domain: Security Operations
- CompTIA Network+Domain: Network Security
- CompTIA CySA+Domain: Security Operations
Free performance-based questions: Security+, Network+, CySA+
Walkthrough
One way to complete the lab, with the reason for each step. Try it yourself first.
Show the worked solution
- 1Rule 1 lets guests go anywhere, so rule 2, which blocks them from the LAN, never applies. Narrow rule 1 to what guests need: allow TCP from Guest Wi-Fi to the Internet on port 443.
- 2With rule 1 narrowed, guests reach nothing else: the implicit deny covers the LAN and the DMZ. Rule 2 can stay or go.
- 3Rule 3 blocks everything from the internet to the DMZ, so rule 4, which allows mail delivery, never applies. Move rule 4 above rule 3, or delete rule 3 and let the implicit deny do its job.
- 4Nothing lets staff read their mail. Add a rule: allow TCP from the Staff LAN to the Mail server on port 993.
- 5Test the rules. All nine requirements should pass.
| # | Action | Source | Destination | Service |
|---|---|---|---|---|
| 1 | allow | Guest Wi-Fi | Internet | TCP 443 |
| 2 | allow | Internet | Mail server | TCP 25 |
| 3 | allow | Staff LAN | Internet | TCP 443 |
| 4 | allow | Staff LAN | Mail server | TCP 993 |
| – | Deny | Any | Any | Any (the implicit deny) |
Guide
How to get the most from a lab
Type the commands yourself
Typing a command, getting it wrong and fixing it is what makes it stick. Use the hints when you’re stuck, not before.
Check the walkthrough afterwards
Every lab has a worked solution with the reason for each step. Read it even when you finished: there is often a shorter way.
Do it again from memory
Reset the lab a day later and do it without hints. If you can, you know it. If you can’t, you’ve found what to study.
More free tools
All free toolsFree Hands-On Labs
14 free labs in your browser: Linux and Windows command line, firewall rules and SOHO router setup, checked as you go.
Open the toolFree Performance-Based Questions
Free performance-based questions for 19 CompTIA exams: firewall rules, network diagrams, command-line tasks and drag-and-drop.
Open the toolFree Practice Tests
Free practice tests for 261 popular certification exams, with explanations and a score by exam domain.
Open the tool
FAQs
Got Questions? We’ve Got Answers.
Find quick answers or contact our support team.
How are my firewall rules checked?
Each requirement is a test packet. The lab sends it through your rules from the top: the first rule that matches decides what happens to it, and a packet that no rule matches is denied, as on a real firewall. You pass when every packet is handled the way the scenario asks.
Is there only one correct rule set?
No. Any rule set that handles every test packet correctly passes, and there are usually several. The walkthrough shows one that works and explains why.
Which exams does this lab help with?
It practices skills from CompTIA Security+ (Security Operations), CompTIA Network+ (Network Security) and CompTIA CySA+ (Security Operations).
Do I need an account?
No. The labs run in your browser and nothing is saved. Sign up only if you want OpenpassAI’s full labs and progress tracking.
