Firewall Configuration: A Practical Guide

Key Takeaways

• Default-deny is a strong starting posture. Everything else is exception management.
• Most real-world firewall weakness is not a missing feature. It is accumulated rules nobody can justify.
• Rules without documented business justification become permanent, because nobody dares remove them.
• Logging that nobody reviews is an expense, not a control.

Start from default-deny

A firewall’s job is to permit what is required and block everything else. That makes deny-all a strong base posture, with explicit permits added as exceptions. A permit-all posture with specific blocks makes it substantially harder to maintain a predictable and secure policy because new traffic is allowed unless it is explicitly blocked.

This sounds obvious and is routinely violated in practice, usually through an any-any rule added during troubleshooting that nobody removed.

When considering firewall configuration, the goal is not simply to create rules that work. It is to create a policy that can be understood, reviewed and maintained over time.

“Every firewall has a rule somebody added at 2am to make something work. Finding it is most of the job.”

Rule design that stays maintainable

If you are learning how to configure a firewall, start with rules that have a clearly defined purpose and owner. The following firewall rules best practices make the policy easier to review and maintain.

1. Be specific on all four elements: source, destination, port and protocol. any in any of them is a decision, not a default.
2. Order matters. Most firewalls evaluate top-down and stop at first match, so a broad rule above a narrow one silently makes the narrow one dead.
3. Name and comment every rule with its business justification and owner. A rule nobody can justify never gets removed.
4. Group logically, so related rules sit together and the intent is readable.
5. Put an explicit deny-and-log at the bottom, even where the implicit default already denies, because it gives you the visibility.
6. Review on a schedule. Rules accumulate; nothing removes them automatically.

Shadowed rule: – A rule that can never match, because a broader rule above it always matches first. Shadowed rules make a policy look more restrictive than it is, and they are common in any ruleset that has grown for a few years.

Segmentation is the control that pays off most

A flat network means any compromised device can reach everything. Segmentation limits how far an intruder gets after the first foothold, reducing the potential scope and impact of an incident.

• Separate user networks from server networks.
• Isolate anything unsupported or unpatchable, including clinical devices and industrial controllers.
• Give guest wireless no route to internal resources at all.
• Separate management interfaces from general traffic.
• Restrict east-west traffic between segments, not just north-south to the internet.

This is also the practical answer to legacy systems you cannot replace. If a machine must run unsupported, segmentation plus monitoring turns it from an open risk into a documented, compensated one, which can provide useful evidence for an auditor or insurer reviewing the risk.

The mistakes that quietly leave you exposed

Logging, monitoring and what happens next

A firewall generates a great deal of data and very little insight on its own. What converts logs into a control is somebody or something reviewing them and acting.

That is why firewall logs typically feed a monitoring or detection capability rather than sitting locally. If nobody looks at them until after an incident, they are a forensic tool rather than a preventative one, which is fine as long as you know that is what you have.

For a baseline to design against, CISA’s Cyber Essentials covers the fundamentals, and NIST’s Cybersecurity Framework 2.0 organizes the wider program around six Functions: Govern, Identify, Protect, Detect, Respond and Recover. NIST describes these Functions as the highest-level structure for organizing cybersecurity outcomes. Eligible organizations can also use CISA’s no-cost vulnerability scanning to get an independent external view of what your firewall is actually exposing.

A review checklist

1. Confirm the default posture is deny.
2. Find and remove any-any rules.
3. Identify shadowed rules that can never match.
4. Reconcile every rule against a current business justification and owner.
5. Reconcile rules against the asset inventory and remove references to decommissioned hosts.
6. Verify management access is not reachable from the internet.
7. Check firmware currency.
8. Confirm logging is forwarded somewhere that is actually monitored.
9. Verify change control is recording who changed what and why.
10. Set the date for the next review before closing this one.