For Teachers · Back to the Module · Print with your browser's Print command.

P12 Worksheet: Firewall Policy Versus What Is Listening

Student Worksheet (about 20 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: P3

Learning Objectives

• [ ] Read incoming allow rules from ufw, nftables and iptables.
• [ ] Correlate firewall rules with listening sockets to find real exposure and stale rules.
• [ ] Explain how Docker's published ports bypass ufw and the INPUT chain.

Key Terms

Write each definition in your own words.

• Firewall: ______________________________________________
• Default Deny: ______________________________________________
• Attack Surface: ______________________________________________
• Stale Rule: ______________________________________________

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --only NET-FW-,NET-LSN- --out p12 and read the exposure map in NET-FW-006 for both labs (--lab vulnerable and --lab hardened).
2. On a test machine with ufw: ufw status verbose and ss -tlnp ; pair every ALLOW rule with a listening socket by hand.
3. Explain in two sentences why ufw deny 8080 does not stop docker run -p 8080:80 nginx.

Self-Check Questions

1. The firewall default-denies incoming traffic but has 'allow 3306 from Anywhere', and MySQL listens on 0.0.0.0. Is MySQL exposed?

• [ ] a) No, the default is deny
• [ ] b) Yes, the allow rule opens it to every address
• [ ] c) Only over IPv6
• [ ] d) No, MySQL asks for a password anyway

1. Why remove an allow rule for a port nothing listens on?

• [ ] a) It slows the firewall
• [ ] b) Anything later started on that port becomes reachable without a decision
• [ ] c) It is required by law
• [ ] d) Firewalls cannot store unused rules

1. Where should you filter traffic to Docker-published ports?

• [ ] a) In ufw only
• [ ] b) In the DOCKER-USER chain, or publish on 127.0.0.1
• [ ] c) In the OUTPUT chain
• [ ] d) In the INPUT chain

1. Which two things must both be true for a service to be reachable from the internet?

• [ ] a) It listens on a non-loopback address and the firewall lets traffic to its port through
• [ ] b) It has a domain name and a certificate
• [ ] c) It runs as root and listens on port 80
• [ ] d) The firewall is off and the service uses TLS

1. ufw reports port 8080 denied, but a container runs with -p 8080:80. What is likely?

• [ ] a) The port is closed, because ufw always wins
• [ ] b) The container port is open, because Docker's rules are reached before ufw's
• [ ] c) Only IPv6 clients can connect
• [ ] d) Docker refuses to start the container

1. How should an allow rule for a port range, such as passive FTP, be handled?

• [ ] a) Delete it automatically
• [ ] b) Review it by hand
• [ ] c) Ignore it, because ranges are always safe
• [ ] d) Change it to allow from anywhere

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy: https://csrc.nist.gov/pubs/sp/800/41/r1/final
• Docker documentation, Packet filtering and firewalls: https://docs.docker.com/engine/network/packet-filtering-firewalls/

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.