Hi my name is Dave Richards from liquid web and today we're going to be looking
at best practices for firewall rules. Your firewall rules are the heart of
your firewall and will work to keep your server and network
safe from outside intrusions.
Believe it or not the first best practice for firewall rules is
documentation, even though it can be tedious.
Documentation ensures that you know what your firewall is doing and
why it's doing it. Good firewall documentation
would include the purpose of each rule, the targeted services affected users and
devices the date it was applied, so you can
backtrack if services or behavior changes.
The expiration date of the rule, if applicable, so that you can remove
unneeded rules from the firewall, and finally the name of the person who
added the rule so you can follow up with them
If changes need to be made. The second best practice is a formal change
procedure. While this might seem overkill for a small business, a formal
change procedure will allow you to keep your firewall rule set up to date and
functioning properly. Users need a way to request
changes once those requests are put in you should have a review process for
those requested changes. Once you've reviewed the requests you
can test those modifications before deploying them
and then of course deploy them into your production environment and validate the
new settings. And finally, again document all the
changes that have been made so that you can convert those changes
if a problem is detected.
So, firewall rules should by default block all traffic that isn't meant to be allowed.
While this can make set up a little bit more complicated,
You definitely want to block as much traffic as you can so that only
allowed and safe traffic is through the firewall into your server or network. So you should set explicit rules first.
Explicit rules are the things that you need the firewall to allow or deny like anti-spoofing filters.
Denying local looking addresses from external sources. The rules that your users are going to need to
be permitted to use the firewall correctly like allowing http traffic to your web server
Management permit rules, if you're going to be managing your firewall from off-site, you'll need to allow for that kind of traffic.
Noise drops like ICMP responses or syn responses, you will want to drop those rules, that traffic so that your firewall can be more efficient.
Next, you'll want to specify rules that should be denied and alerted that indicate suspicious behavior or malicious
behavior on your firewall. You want to be alerted to an attack. And finally, you can apply those rules that simply deny
and log behavior it's less likely to be suspicious, but you want to be able to review that behavior in the logs
you should also set an and explicit drop rule
once you've identified the traffic that should be allowed, you should drop
everything else. A typical drop rule is source any destination any service any
action drop. And logging in so that you can check to see what kind of behavior is being dropped.
You should remove any except all loops, as some firewalls may come with some accept
all rules built in to make them easier to set up, but they're not safe. You should always audit your logs periodically.
Those logs are there for a reason. Watch for traffic that might be attacking your
server or network and you can then take steps to
adjust them. You should review the rules periodically to make sure
that only traffic that's needed is being allowed in the firewall.
And finally. keep your firewall up to date. The best rule set in the world
won't help if your firewall is out of date and
vulnerable to attack. Thank you for watching best practices of
firewall rules. For more information on this topic or
other helpful tutorials, please visit our knowledge base at www.liquidweb.com/kb,
or see our videos at www.youtube.com/liquidwebinc.