Read the scenario first
Each lab starts with a situation, the way a ticket or an exam question does. Work out what is being asked before you type anything.
Free tool · No sign-up needed
Firewall Rules Lab: A Web Server in a DMZ
Write the rule set for a firewall between the internet, a DMZ and a LAN, then test it against nine requirements.
Last updated
Firewall rules · Intermediate · About 12 minutes
The scenario
A company hosts its own website. The web server sits in a DMZ, the database it uses sits on the internal LAN, and one firewall separates the internet, the DMZ and the LAN. Whoever set the firewall up left a single rule that allows everything.
Replace it with a rule set that follows least privilege: customers reach the website, one administrator can manage the web server, the web server can query its database, and nothing else gets through. The firewall reads its rules from the top, and the first rule that matches a packet decides what happens to it.
A simulated firewall that runs in your browser. Your rules are tested with the packets the scenario describes.
Perimeter firewall, between the internet, the DMZ and the LAN
- Internet (any outside address)
- DMZ 172.16.0.0/24
- Web server 172.16.0.10, in the DMZ
- LAN 192.168.10.0/24
- Admin PC 192.168.10.50, on the LAN
- Database server 192.168.10.20, on the LAN
#ActionProtocolSourceDestinationPort
- Rule 1
- 2 · Implicit deny: anything no rule above matches is blocked.
What the firewall must do
- Customers on the internet can open the website over HTTPS.
- HTTP from the internet reaches the web server too, so it can redirect to HTTPS.
- Nobody on the internet can reach SSH on the web server.
- The admin PC can manage the web server over SSH.
- Other computers on the LAN can’t SSH to the web server.
- The web server can query the database on port 3306.
- Other machines in the DMZ can’t reach the database.
- The internet can’t reach the database.
- The web server can’t open file shares on the LAN.
Take it further in OpenpassAI
More labs for the certification you’re studying
OpenpassAI’s Hands-on Labs put you in a Linux or Windows terminal for the certification you’re studying, in guided, hint-only and timed modes.
About this lab
What you’ll practice, and where it’s tested
What you’ll practice
- Allowing only the ports a service needs
- Limiting a rule to one source address
- Relying on the implicit deny
- Reading a rule set the way the firewall does, top to bottom
Exams it helps with
- CompTIA Security+Domain: Security Operations
- CompTIA Network+Domain: Network Security
- CompTIA SecurityXDomain: Security Engineering
Free performance-based questions: Security+, Network+, SecurityX
Walkthrough
One way to complete the lab, with the reason for each step. Try it yourself first.
Show the worked solution
- 1Delete the rule that allows everything. With no rules at all, the implicit deny blocks every packet, which is the right starting point.
- 2Allow TCP from the Internet to the Web server on port 443, and add a second rule for port 80.
- 3Allow TCP from the Admin PC to the Web server on port 22. Choosing the Admin PC as the source, not the LAN, keeps other LAN computers out.
- 4Allow TCP from the Web server to the Database server on port 3306. Choosing the Web server, not the DMZ, keeps other DMZ machines out.
- 5Add nothing else. Everything the rules don’t mention is blocked by the implicit deny, so no deny rules are needed.
| # | Action | Source | Destination | Service |
|---|---|---|---|---|
| 1 | allow | Internet | Web server | TCP 443 |
| 2 | allow | Internet | Web server | TCP 80 |
| 3 | allow | Admin PC | Web server | TCP 22 |
| 4 | allow | Web server | Database server | TCP 3306 |
| – | Deny | Any | Any | Any (the implicit deny) |
Guide
How to get the most from a lab
Type the commands yourself
Typing a command, getting it wrong and fixing it is what makes it stick. Use the hints when you’re stuck, not before.
Check the walkthrough afterwards
Every lab has a worked solution with the reason for each step. Read it even when you finished: there is often a shorter way.
Do it again from memory
Reset the lab a day later and do it without hints. If you can, you know it. If you can’t, you’ve found what to study.
More free tools
All free toolsFree Hands-On Labs
14 free labs in your browser: Linux and Windows command line, firewall rules and SOHO router setup, checked as you go.
Open the toolFree Performance-Based Questions
Free performance-based questions for 19 CompTIA exams: firewall rules, network diagrams, command-line tasks and drag-and-drop.
Open the toolFree Practice Tests
Free practice tests for 261 popular certification exams, with explanations and a score by exam domain.
Open the tool
FAQs
Got Questions? We’ve Got Answers.
Find quick answers or contact our support team.
How are my firewall rules checked?
Each requirement is a test packet. The lab sends it through your rules from the top: the first rule that matches decides what happens to it, and a packet that no rule matches is denied, as on a real firewall. You pass when every packet is handled the way the scenario asks.
Is there only one correct rule set?
No. Any rule set that handles every test packet correctly passes, and there are usually several. The walkthrough shows one that works and explains why.
Which exams does this lab help with?
It practices skills from CompTIA Security+ (Security Operations), CompTIA Network+ (Network Security) and CompTIA SecurityX (Security Engineering).
Do I need an account?
No. The labs run in your browser and nothing is saved. Sign up only if you want OpenpassAI’s full labs and progress tracking.
