Firewall rule
A firewall rule is a network access-control specification that permits or denies matching traffic according to defined characteristics and conditions.
Cyber Threat Hunting
A firewall rule is a configuration that specifies network traffic conditions and the action a firewall takes when those conditions match.
- How it is used
- Uses firewall rules to investigate unexpected incoming traffic, attribute exposure to configuration changes, and support incident response.
- How deep it goes
- Explains rule-based traffic attribution through timelines and fields, but stops short of proving that an allowed connection became an established session.
- Examples
- Uses GCP queries, destination-port charts, rule references, scanner findings, and the test-allow-all exposure case.
- What you can do after
- Diagnose with GCP firewall logs by locating unexpected ports, identifying the allowing rule, and documenting or escalating the exposure.
Amazon Web Services in Action, Third Edition: An in-depth guide to AWS
A firewall rule is a configuration statement that allows or blocks network traffic according to specified criteria.
- How it is used
- Controls inbound and outbound traffic for EC2 instances, databases, load balancers, subnets, and private application architectures.
- How deep it goes
- Defines matching criteria, security-group defaults, least-privilege guidance, and troubleshooting, then contrasts stateful security groups with prioritized NACL rules.
- Examples
- Uses HTTP access to EC2, MySQL access from web servers to RDS, and proxy-subnet traffic governed by NACL entries.
- What you can do after
- Apply it via AWS security groups and CloudFormation to expose required services while restricting unnecessary network paths.
Related concepts
- firewallused by · A firewall is a network security system that monitors and filters communications according to rules governing which traffic is permitted or blocked.
- Azure Storage firewallused by · Azure Storage firewall is a network access-control feature that restricts requests to Azure Storage accounts based on network locations and resource sources.
- network security groupequivalent to · A network security group is an Azure access-control resource that filters inbound and outbound network traffic using prioritized security rules.
- inbound connectionconfigures · An inbound connection is a network connection initiated from an external source toward a local host or service.
- security groupequivalent to · A security group is a virtual firewall configuration that controls permitted inbound and outbound network traffic for associated cloud resources.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.