Security 12-21Firewall design rulesThere are two basic rules to firewall design: “What is not explicitly allowed is denied.”and “What is not explicitly denied is allowed.”The first rule is far more secure, and is the best approach to firewall design. It is far easier (and more secure)to allow in or out only certain services and deny anything else. If the other rule is used, you would have to figureout everything that you want to disallow, now and in the future.Firewall LogicFirewall design is a test of logic, and filter rule ordering is critical. If a packet is forwarded through a series offilter rules and then the packet matches a rule, the appropriate action is taken. The packet will not forwardthrough the remainder of the filter rules.For example, if you had the following filter set...Allow WWW access;Allow FTP access;Allow SMTP access;Deny all other packets.and a packet goes through these rules destined for FTP, the packet would forward through the first rule (WWW),go through the second rule (FTP), and match this rule; the packet is allowed through.If you had this filter set for example....Allow WWW access;Allow FTP access;Deny FTP access;Deny all other packets.and a packet goes through these rules destined for FTP, the packet would forward through the first filter rule(WWW), match the second rule (FTP), and the packet is allowed through. Even though the next rule is to deny allFTP traffic, the FTP packet will never make it to this rule.Binary representationIt is easiest when doing filtering to convert the IP address and mask in question to binary. This will allow you toperform the logical AND to determine whether a packet matches a filter rule.69 TFTP387 AURPUDP Port Service
