← Back to Articles

Firewall Configuration and Rule Management: Building a Defense That Actually Works

October 20, 2023•Network Security•4 min read

Three years ago, I inherited a firewall with 4,200 rules. Over 1,100 of them were shadowed, 600 referenced decommissioned hosts, and nobody could explain what half of them did. If that sounds familiar, you're not alone—and this post is the playbook I wish I'd had on day one.

The Real Problem: Rule Entropy

Firewalls don't fail dramatically. They decay quietly. Every emergency change request, every "temporary" allow rule, and every migration leftover adds noise to your policy base. Over months and years, this rule entropy creates blind spots that attackers exploit and auditors flag.

Effective firewall management isn't just about knowing iptables syntax—it's about building processes that prevent decay.

Start With a Baseline: Document Everything

Before touching a single rule, establish a baseline. Export your current ruleset and map every rule to a business justification. Here's how to pull your current rules on a Linux host using nftables:

# Export current ruleset to a file for review
nft list ruleset > /etc/nftables-baseline-$(date +%F).conf

# Count total rules
nft list ruleset | grep -c "rule"

For Palo Alto environments:

# Export security policy via CLI
show running security-policy | match "from\|to\|application\|action"

Tag every rule with an owner, a ticket number, and an expiration date. If a rule can't be justified, it's a candidate for removal.

Implement a Tiered Rule Structure

Flat rule lists are unmanageable at scale. Organize your policies into logical tiers:

  1. Global Deny Rules — Block known-bad IPs, bogons, and RFC 1918 on external interfaces
  2. Compliance Rules — PCI-DSS segmentation, HIPAA zone isolation
  3. Application Rules — Service-specific access (e.g., web tier to app tier on TCP/443)
  4. Temporary Rules — Emergency access with hard expiration dates
  5. Default Deny — Explicit drop-all at the bottom of every chain

Here's a clean nftables example implementing this structure:

#!/usr/sbin/nft -f

flush ruleset

table inet firewall {
    chain input {
        type filter hook input priority 0; policy drop;

        # Tier 1: Global deny - bogon and known-bad sources
        ip saddr { 0.0.0.0/8, 169.254.0.0/16, 224.0.0.0/3 } drop

        # Tier 2: Stateful tracking
        ct state established,related accept
        ct state invalid drop

        # Tier 3: Application-specific rules
        tcp dport 22 ip saddr 10.10.5.0/24 accept comment "SSH from admin VLAN - TICKET-4821"
        tcp dport 443 accept comment "HTTPS inbound - TICKET-3190"

        # Tier 4: Temporary access - EXPIRES 2025-02-28
        tcp dport 8080 ip saddr 192.168.50.12 accept comment "Temp debug access - TICKET-5023"

        # Tier 5: Default deny with logging
        log prefix "DROPPED: " counter drop
    }
}

Notice every rule carries a comment with a ticket reference. This is non-negotiable in enterprise environments.

Automate Rule Lifecycle Management

Temporary rules are the most dangerous rules. Automate their expiration:

# Cron job to remove expired temporary rules (runs daily at midnight)
0 0 * * * /usr/bin/nft list ruleset | grep "EXPIRES $(date +\%F)" && \
  /usr/local/bin/remove-expired-rules.sh | logger -t firewall-cleanup

Pair this with a change management workflow: every rule request requires a ticket, a peer review, and a defined TTL.

Audit Continuously, Not Annually

Schedule monthly rule audits. Look for:

  • Shadowed rules — rules that never match because a broader rule precedes them
  • Hit count of zero — rules that haven't matched traffic in 90+ days
  • Any-any rules — these should never exist in production
  • Orphaned object references — hosts or subnets that no longer exist
# Check for rules with zero packet hits
nft list ruleset -a | grep "counter packets 0"

Final Thought

A firewall is only as strong as the discipline behind its management. The technology is mature—what separates a secure environment from a breached one is operational rigor: documented rules, automated lifecycle enforcement, and continuous auditing. Treat your firewall policy like production code. Version it, review it, and never let "temporary" become permanent.

Have questions about firewall configuration and rule management? I'm always happy to talk shop — reach out or connect with me on LinkedIn.

← Back to Articles