Firewall Testing Checklist

Firewalls are critical for network security, acting as barriers between trusted and untrusted networks. Properly testing firewalls ensures they effectively block malicious traffic while allowing legitimate communications. Below is a detailed checklist for firewall testing, along with practical commands and steps to verify configurations.

Default Deny Rule – Ensure the firewall defaults to blocking all traffic unless explicitly allowed.

– Linux (iptables):

sudo iptables -L | grep "policy DROP"

– Windows (PowerShell):

Get-NetFirewallProfile | Select-Object Name, DefaultInboundAction, DefaultOutboundAction

Allow Necessary Ports Only – Verify only required ports (HTTP/80, HTTPS/443, SSH/22) are open.

– Check Open Ports (Linux):

sudo netstat -tuln

– Check Open Ports (Windows):

netstat -ano

Logging & Monitoring – Ensure firewall logs traffic for analysis.

– Linux (iptables logging):

sudo iptables -A INPUT -j LOG --log-prefix "IPTABLES-DROPPED: "

– Windows (Enable Logging):

Set-NetFirewallProfile -Profile Domain,Public,Private -LogAllowed True -LogBlocked True

Stateful Inspection – Confirm the firewall tracks active connections.

– Linux (Check conntrack):

sudo conntrack -L

Prevent IP Spoofing – Block packets with internal IPs coming from outside.

– Linux (iptables anti-spoofing):

sudo iptables -A INPUT -i eth0 -s 192.168.1.0/24 -j DROP

Test Firewall Rules – Use `nmap` or `hping3` to test rule effectiveness.

– Scan Open Ports:

nmap -sS -p 1-1000 <target_IP>

– Test ICMP Blocking:

hping3 -1 <target_IP>

You Should Know:

Firewall Rule Persistence (Linux):

sudo iptables-save > /etc/iptables/rules.v4

Block Brute-Force Attacks (Fail2Ban):

sudo apt install fail2ban
sudo systemctl enable fail2ban

Windows Firewall Advanced Rules:

New-NetFirewallRule -DisplayName "Block RDP" -Direction Inbound -Protocol TCP -LocalPort 3389 -Action Block

What Undercode Say:

A well-configured firewall is the first line of defense against cyber threats. Regular testing ensures no misconfigurations or overlooked vulnerabilities exist. Automation tools like nmap, iptables, and PowerShell cmdlets simplify auditing. Always log firewall activity and review logs for anomalies.