A ruleset is not a list of things to block. It is a list of things to permit, ending in a refusal of everything else, and rulesets built the other way become unmaintainable within a year.
Three properties determine whether a ruleset can be reasoned about at all.
Default deny is the only workable base
Enumerating what is permitted is finite and knowable. Enumerating what is dangerous is neither, because the list grows with every new service and every new technique.
A ruleset ending in a permit is not a policy, it is a delay. Anything not explicitly considered is allowed, and the gaps are invisible until something uses them.
First match wins, so order is logic
Rules are evaluated top to bottom and evaluation stops at the first match. A correct rule placed below a broader one never executes, and nothing reports this.
The practical consequence is that specific rules go above general ones, and a ruleset that has been edited by several people over years usually contains rules that cannot be reached. Auditing for unreachable rules is worth doing periodically.
State tracking removes most of the work
| Approach | Return traffic | Consequence |
|---|---|---|
| Stateless | Needs its own permit rule | Roughly double the rules, wider holes |
| Stateful | Matched automatically | Half the rules, tighter policy |
A stateful firewall records outbound connections and permits the matching replies without a rule. This is why a modern ruleset begins by accepting established traffic and then only describes new connections.
Outbound is the half that gets skipped
Most rulesets constrain what may enter and permit anything to leave, which addresses intrusion and ignores everything that happens afterwards.
Restricting outbound traffic limits data exfiltration, blocks callbacks to external infrastructure, and frequently reveals unexpected dependencies. It is harder to implement because it breaks things visibly, and that visibility is the point.
Where the filter sits changes what it can see
A perimeter device sees traffic crossing a boundary and nothing that stays inside it, which is why a single perimeter offers no protection once something is already on the internal network.
Filtering between segments constrains lateral movement, which is the phase where an intrusion becomes an incident. Filtering on the host itself sees traffic no network device can, including loopback and traffic between containers on one machine.
These are complementary rather than alternatives, and relying on any one of them alone leaves a predictable gap.
Log the refusals, not everything
Logging every permitted packet produces volume nobody reads. Logging refusals produces a signal, because a refusal is either an attempt at something unauthorised or a rule that is wrong.
Both are worth knowing. A refusal that recurs from an internal host is usually a missing rule rather than an attack, and finding those is how a ruleset converges on correct.
Rules age badly
Every rule was added for a reason that was obvious at the time and is not recorded anywhere. Systems are decommissioned, applications change ports, and the rules permitting them remain.
A periodic review comparing rules against traffic counters identifies rules that have matched nothing in months, which are candidates for removal. Doing this on a schedule keeps the ruleset roughly the size of the actual requirement rather than the accumulated history of it.
The recurring mistakes
Permitting any source to any destination as a temporary measure, which becomes permanent because nothing breaks and nobody revisits it. Adding rules without removing superseded ones, until nobody can say what the policy is. Leaving rules undocumented, so no one knows which are still required.
The most consequential is exposing management interfaces. Administrative access reachable from anywhere is a standing invitation, and restricting it to known sources is the single highest value rule in most rulesets.
Note: a ruleset nobody can explain is not a control. If the reason for a rule is not recorded, it will either be removed when it was needed or kept forever when it was not.