--- title: "P12: Firewall Policy Versus What Is Listening" canonical: https://openvapt.com/academy/p12.html html: https://openvapt.com/academy/p12.html site: OpenVAPT, https://openvapt.com/ license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html modified: 2026-10-16 version: 0.1.0-alpha.6 --- # P12: Firewall Policy Versus What Is Listening Why "the firewall is on" is not the same as "the service is protected". How to compare firewall rules with the sockets that are really open. - Level: Practitioner - Time: about 20 minutes - Read first: P3 ## You Will Be Able To - Read incoming allow rules from ufw, nftables and iptables. - Correlate firewall rules with listening sockets to find real exposure and stale rules. - Explain how Docker's published ports bypass ufw and the INPUT chain. ## Exposure Has Two Halves A service is reachable from the internet when it listens on a non-loopback address and the firewall lets traffic to its port through. Checking either half alone misleads. A default-deny firewall with "allow 3306 from anywhere" exposes the database as much as no firewall at all. An allow rule for a port nothing listens on is a hole waiting for the next service. OpenVAPT reads the listening sockets from /proc/net. It reads the incoming allow rules from ufw status verbose, nft list ruleset or iptables -S. Then it labels each socket: allowed from anywhere, allowed from a restricted source, blocked by default deny, or reachable because nothing filters it. ## Stale Rules Rules outlive the services they were added for. Each single-port allow rule should match something that listens; if it does not, delete it or write down why it stays. Ranges (for passive FTP or media) are reviewed by hand. ## Docker and the Firewall Docker writes its own iptables rules for published ports (-p 8080:80) into the nat table and the DOCKER chain. Traffic reaches them before ufw's rules or the INPUT policy. A container port can therefore be open to the world while ufw reports it denied. Publish on 127.0.0.1 behind a reverse proxy, or filter in the DOCKER-USER chain, which Docker evaluates first and never overwrites. ## In Summary A firewall rule only matters if it matches what is listening. Compare the two lists. Remove stale rules and close unexpected ports. ## Apply It - [NET-FW-003 Firewall Allows Sensitive Services From Anywhere](https://openvapt.com/checks/NET-FW-003.md) (high) - [NET-FW-004 Firewall Rules Open Ports With No Service](https://openvapt.com/checks/NET-FW-004.md) (low) - [NET-FW-005 Container Ports Bypass the Host Firewall](https://openvapt.com/checks/NET-FW-005.md) (medium) - [NET-FW-006 Firewall Exposure Map of Listening Services](https://openvapt.com/checks/NET-FW-006.md) (info) ## Lab 1. `Run: openvapt demo --only NET-FW-,NET-LSN- --out p12 and read the exposure map in NET-FW-006 for both labs (--lab vulnerable and --lab hardened).` 2. `On a test machine with ufw: ufw status verbose and ss -tlnp ; pair every ALLOW rule with a listening socket by hand.` 3. `Explain in two sentences why ufw deny 8080 does not stop docker run -p 8080:80 nginx.` ## Check Yourself Answer keys are public for every channel (see Teaching With OpenVAPT). 1. The firewall default-denies incoming traffic but has 'allow 3306 from Anywhere', and MySQL listens on 0.0.0.0. Is MySQL exposed? - A. No, the default is deny - B. Yes, the allow rule opens it to every address - C. Only over IPv6 - D. No, MySQL asks for a password anyway - Answer: B. An explicit allow rule overrides the default policy for that port. A password is a separate layer, not a firewall. 2. Why remove an allow rule for a port nothing listens on? - A. It slows the firewall - B. Anything later started on that port becomes reachable without a decision - C. It is required by law - D. Firewalls cannot store unused rules - Answer: B. Stale rules are latent exposure waiting for the next service. 3. Where should you filter traffic to Docker-published ports? - A. In ufw only - B. In the DOCKER-USER chain, or publish on 127.0.0.1 - C. In the OUTPUT chain - D. In the INPUT chain - Answer: B. Docker's rules are reached before ufw and the INPUT chain. DOCKER-USER is evaluated first and Docker never overwrites it. 4. Which two things must both be true for a service to be reachable from the internet? - A. It listens on a non-loopback address and the firewall lets traffic to its port through - B. It has a domain name and a certificate - C. It runs as root and listens on port 80 - D. The firewall is off and the service uses TLS - Answer: A. Exposure has two halves. Checking either one alone misleads. 5. ufw reports port 8080 denied, but a container runs with -p 8080:80. What is likely? - A. The port is closed, because ufw always wins - B. The container port is open, because Docker's rules are reached before ufw's - C. Only IPv6 clients can connect - D. Docker refuses to start the container - Answer: B. Docker writes its own rules for published ports, so ufw never sees that traffic. 6. How should an allow rule for a port range, such as passive FTP, be handled? - A. Delete it automatically - B. Review it by hand - C. Ignore it, because ranges are always safe - D. Change it to allow from anywhere - Answer: B. A range cannot be matched to one listener, so a person decides whether it still has a purpose. ## Key Terms - Firewall: Software or hardware that allows or blocks network traffic according to rules. - Default Deny: A firewall or access policy that blocks everything except what is explicitly allowed. - Attack Surface: All the points where an attacker could try to interact with a system, such as listening ports, web pages and accounts. - Stale Rule: A firewall rule that no longer matches a running service and so leaves an unexplained opening. ## References - [NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy](https://csrc.nist.gov/pubs/sp/800/41/r1/final) - [Docker documentation, Packet filtering and firewalls](https://docs.docker.com/engine/network/packet-filtering-firewalls/) Offline: `openvapt learn P12`. --- OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/academy/p12.html. Part of OpenVAPT Academy. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.