Understanding Firewalls & Ports

Go: open a terminal in a folder you can write to (mkdir fw-lab && cd fw-lab) and open your text editor.

Do: save this as firewall.py and run python3 firewall.py. The rules allow three ways in; the default drops everything else.

rules = [
    ("tcp", 22,  "ACCEPT"),   # SSH
    ("tcp", 443, "ACCEPT"),   # HTTPS
    ("tcp", 80,  "ACCEPT"),   # HTTP
]
DEFAULT = "DROP"

def decide(proto, port):
    for r_proto, r_port, verdict in rules:   # top to bottom, first match wins
        if proto == r_proto and port == r_port:
            return verdict, "rule %s/%d" % (r_proto, r_port)
    return DEFAULT, "default policy"

for proto, port in [("tcp",22),("tcp",443),("tcp",3306),("tcp",23),("udp",53)]:
    verdict, why = decide(proto, port)
    print("%-5s port %-5d -> %-6s (%s)" % (proto, port, verdict, why))

You should see: the two allowed ports pass, and everything else is dropped by the default — nobody had to write a rule for the database or telnet:

tcp   port 22    -> ACCEPT (rule tcp/22)
tcp   port 443   -> ACCEPT (rule tcp/443)
tcp   port 3306  -> DROP   (default policy)
tcp   port 23    -> DROP   (default policy)
udp   port 53    -> DROP   (default policy)

If not: a SyntaxError almost always means a mistyped bracket or a missing comma in the rules list — the arrows in the output are -> (a hyphen and a greater-than), and Python prints them literally from the format string; you do not type any special character.

Go: same file.

Do: your team just launched a service on port 8080. Add one rule for it to the rules list and add ("tcp",8080) to the test packets, then run it again.

    ("tcp", 8080, "ACCEPT"),   # new internal dashboard

You should see: port 8080 now prints ACCEPT (rule tcp/8080) where before it would have been dropped by the default. That single line is what “opening a port in the firewall” means — no more, no less.

If not: if 8080 still drops, you added the rule but forgot to add ("tcp",8080) to the list of packets being tested, so nothing is asking about it. The rule list and the traffic are two separate things.

Go: a fresh file, order.py.

Do: put a DROP for port 3306 above an ACCEPT for the same port, then ask about a packet to 3306.

rules = [
    ("tcp", 3306, "DROP"),     # block the database port
    ("tcp", 3306, "ACCEPT"),   # a later ACCEPT for the same port
]
def decide(port):
    for rp, rport, v in rules:
        if rp=="tcp" and rport==port:
            return v
    return "DROP"
print("packet tcp/3306 ->", decide(3306))
print("(the ACCEPT below the DROP never runs)")

You should see: packet tcp/3306 -> DROP. The ACCEPT written underneath it is dead — the loop stops at the first line that matches. This is why a real firewall’s rule order is not cosmetic: a broad DROP placed too high can silently cancel every specific ALLOW beneath it.

If not: if you get ACCEPT, you have the two rules in the other order — put the DROP first, as shown, to see the effect.

Go: a fresh file, default.py.

Do: flip the default from DROP to ACCEPT, keep a single rule that blocks the database, and test three services — one you remembered and two you did not.

rules = [("tcp", 3306, "DROP")]   # you remembered the database
DEFAULT = "ACCEPT"                # ...but the default lets everything else in
def decide(port):
    for rp, rport, v in rules:
        if rp=="tcp" and rport==port: return v
    return DEFAULT
for port, name in [(3306,"database"),(6379,"redis you forgot"),(9200,"search you forgot")]:
    print("%-18s tcp/%-5d -> %s" % (name, port, decide(port)))

You should see: the database is blocked, but the two services you never wrote a rule for are wide open:

database           tcp/3306  -> DROP
redis you forgot   tcp/6379  -> ACCEPT
search you forgot  tcp/9200  -> ACCEPT

This is the whole argument for default deny. With DEFAULT = "DROP" you can only be exposed by a port you explicitly opened; with DEFAULT = "ACCEPT" you are exposed by every port you forgot, which is an endless list. Deny by default, then allow the few things you actually need.

If not: if everything shows DROP, you left DEFAULT as "DROP" — the point of this step is to set it to "ACCEPT" and watch the forgotten services leak.

Go: a terminal on your own Linux computer. This step only reads; it enables nothing and blocks nothing.

Do: run sudo ufw status verbose. On a Red Hat-family system use sudo firewall-cmd --list-all instead.

You should see: either Status: inactive (no firewall is running yet) or a Default: line followed by your real ALLOW rules — the same shape you just built in Python, now enforced by the kernel. Read the Default: line first: deny (incoming) is the posture you want.

If not: ufw: command not found means it is not installed (sudo apt install ufw); installing it changes nothing until you enable it. When you are ready to turn a firewall on safely — allowing your own SSH in before you close the door, so you never lock yourself out — follow Set Up a UFW Firewall step by step.