Rules and Policies
Allow and deny traffic.
Rules and Policies is a free Cyber Security Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What Is a Firewall Rule
A firewall rule tells the firewall what to do with traffic that matches certain conditions.
Each rule has a match (such as source, destination, port) and an action (allow or deny).
Rule: allow tcp from any to 10.0.0.5 port 443
Meaning: permit HTTPS traffic to the web server.Allow and Deny
The two core actions are allow (permit the traffic) and deny (block it).
Some firewalls distinguish drop (silently discard) from reject (block and notify the sender).
Default Deny
The safest design is default deny: block everything, then allow only what is explicitly needed.
This whitelist approach minimizes the attack surface.
Rule Order Matters
Firewalls evaluate rules top to bottom and stop at the first match.
A broad allow rule placed above a specific deny rule can accidentally let bad traffic through.
1. allow tcp any -> any port 80
2. deny tcp 203.0.113.7 -> any
Rule 2 never fires for port 80 because rule 1 matches first.Five-Tuple Matching
Most rules match on the five-tuple:
- Source IP
- Destination IP
- Source port
- Destination port
- Protocol
These five fields uniquely describe a flow.
Inbound and Outbound
Rules apply by direction.
- Inbound - traffic entering your network
- Outbound - traffic leaving it
Filtering outbound traffic helps stop malware from calling home.
From Rules to Policy
A firewall policy is the full set of rules plus the principles behind them.
It reflects business needs: who may reach what, from where, and why.
Least Privilege
Apply the principle of least privilege: open only the specific ports and sources each service truly needs.
Avoid broad rules like 'allow any to any', which defeat the purpose of a firewall.
Logging and Monitoring
Rules should log important traffic, especially denied connections.
Logs reveal attack attempts and help troubleshoot why legitimate traffic was blocked.
Reviewing Rules
Firewall rule sets grow messy over time.
Regular reviews remove unused or overly broad rules, reducing risk and keeping the policy understandable.
Change Control
Rule changes should follow a process.
- Request and justify the change
- Review and approve it
- Document who changed what and when
This prevents risky, untracked edits.
Quick Check
Test your understanding of firewall rules and policies.
Recap
Effective firewall policy uses:
- Default deny with explicit allows
- Correct rule order and least privilege
- Logging, regular review, and change control
Good rules are specific, ordered, and documented.
Frequently asked questions
Is the “Rules and Policies” lesson free?
Yes — the full text of “Rules and Policies” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Rules and Policies”?
Allow and deny traffic. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Rules and Policies” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Firewall Types
- Rules and Policies
- Network Segmentation
- DMZ Design