Firewall Policy Versus What Is Listening

Exposure Has Two Halves

A service is reachable from the internet when it listens on a non-loopback address and the firewall lets traffic to its port through. Checking either half alone misleads. A default-deny firewall with "allow 3306 from anywhere" exposes the database as much as no firewall at all. An allow rule for a port nothing listens on is a hole waiting for the next service.

OpenVAPT reads the listening sockets from /proc/net. It reads the incoming allow rules from ufw status verbose, nft list ruleset or iptables -S. Then it labels each socket: allowed from anywhere, allowed from a restricted source, blocked by default deny, or reachable because nothing filters it.

Stale Rules

Rules outlive the services they were added for. Each single-port allow rule should match something that listens; if it does not, delete it or write down why it stays. Ranges (for passive FTP or media) are reviewed by hand.

Docker and the Firewall

Docker writes its own iptables rules for published ports (-p 8080:80) into the nat table and the DOCKER chain. Traffic reaches them before ufw's rules or the INPUT policy. A container port can therefore be open to the world while ufw reports it denied. Publish on 127.0.0.1 behind a reverse proxy, or filter in the DOCKER-USER chain, which Docker evaluates first and never overwrites.

In Summary

A firewall rule only matters if it matches what is listening. Compare the two lists. Remove stale rules and close unexpected ports.

Apply It

These OpenVAPT checks put this module into practice. Open one to see its detection logic and source code.

Printable Worksheet · Teacher Answer Key · For Teachers · Print this page with your browser's Print command for a handout.

Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.

Lab

1. Run: openvapt demo --only NET-FW-,NET-LSN- --out p12 and read the exposure map in NET-FW-006 for both labs (--lab vulnerable and --lab hardened).
2. On a test machine with ufw: ufw status verbose and ss -tlnp ; pair every ALLOW rule with a listening socket by hand.
3. Explain in two sentences why ufw deny 8080 does not stop docker run -p 8080:80 nginx.

Check Yourself

Answers are checked in your browser and never stored or sent.

References

• NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy
• Docker documentation, Packet filtering and firewalls

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under Teaching With OpenVAPT. Pre-release material may be wrong or unstable; use at your own risk.

OpenVAPT. (2026). P12: Firewall Policy Versus What Is Listening (Version 0.1.0-alpha.6). OpenVAPT Academy. Retrieved October 16, 2026, from https://openvapt.com/academy/p12.html

@misc{openvapt_p12,
  author       = {{OpenVAPT}},
  title        = {{P12: Firewall Policy Versus What Is Listening}},
  year         = {2026},
  howpublished = {\url{https://openvapt.com/academy/p12.html}},
  note         = {OpenVAPT Academy, version 0.1.0-alpha.6. Accessed 16 October 2026}
}