For Teachers · Back to the Module · Print with your browser's Print command.

P12 Teacher Answer Key: Firewall Policy Versus What Is Listening

Teacher Answer Key (about 20 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: P3

Learning Objectives

• [ ] Read incoming allow rules from ufw, nftables and iptables.
• [ ] Correlate firewall rules with listening sockets to find real exposure and stale rules.
• [ ] Explain how Docker's published ports bypass ufw and the INPUT chain.

Key Terms

Write each definition in your own words.

• Firewall: Software or hardware that allows or blocks network traffic according to rules.
• Default Deny: A firewall or access policy that blocks everything except what is explicitly allowed.
• Attack Surface: All the points where an attacker could try to interact with a system, such as listening ports, web pages and accounts.
• Stale Rule: A firewall rule that no longer matches a running service and so leaves an unexplained opening.

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --only NET-FW-,NET-LSN- --out p12 and read the exposure map in NET-FW-006 for both labs (--lab vulnerable and --lab hardened).
2. On a test machine with ufw: ufw status verbose and ss -tlnp ; pair every ALLOW rule with a listening socket by hand.
3. Explain in two sentences why ufw deny 8080 does not stop docker run -p 8080:80 nginx.

Self-Check Questions

1. The firewall default-denies incoming traffic but has 'allow 3306 from Anywhere', and MySQL listens on 0.0.0.0. Is MySQL exposed?

• [ ] a) No, the default is deny
• [x] b) Yes, the allow rule opens it to every address
• [ ] c) Only over IPv6
• [ ] d) No, MySQL asks for a password anyway
• Answer: b. An explicit allow rule overrides the default policy for that port. A password is a separate layer, not a firewall.

1. Why remove an allow rule for a port nothing listens on?

• [ ] a) It slows the firewall
• [x] b) Anything later started on that port becomes reachable without a decision
• [ ] c) It is required by law
• [ ] d) Firewalls cannot store unused rules
• Answer: b. Stale rules are latent exposure waiting for the next service.

1. Where should you filter traffic to Docker-published ports?

• [ ] a) In ufw only
• [x] b) In the DOCKER-USER chain, or publish on 127.0.0.1
• [ ] c) In the OUTPUT chain
• [ ] d) In the INPUT chain
• Answer: b. Docker's rules are reached before ufw and the INPUT chain. DOCKER-USER is evaluated first and Docker never overwrites it.

1. Which two things must both be true for a service to be reachable from the internet?

• [x] a) It listens on a non-loopback address and the firewall lets traffic to its port through
• [ ] b) It has a domain name and a certificate
• [ ] c) It runs as root and listens on port 80
• [ ] d) The firewall is off and the service uses TLS
• Answer: a. Exposure has two halves. Checking either one alone misleads.

1. ufw reports port 8080 denied, but a container runs with -p 8080:80. What is likely?

• [ ] a) The port is closed, because ufw always wins
• [x] b) The container port is open, because Docker's rules are reached before ufw's
• [ ] c) Only IPv6 clients can connect
• [ ] d) Docker refuses to start the container
• Answer: b. Docker writes its own rules for published ports, so ufw never sees that traffic.

1. How should an allow rule for a port range, such as passive FTP, be handled?

• [ ] a) Delete it automatically
• [x] b) Review it by hand
• [ ] c) Ignore it, because ranges are always safe
• [ ] d) Change it to allow from anywhere
• Answer: b. A range cannot be matched to one listener, so a person decides whether it still has a purpose.

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy: https://csrc.nist.gov/pubs/sp/800/41/r1/final
• Docker documentation, Packet filtering and firewalls: https://docs.docker.com/engine/network/packet-filtering-firewalls/

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.