Tutorials · Security
How to Write Firewall Rules That Actually Protect You
Default-deny, least privilege and clean rule bases: practical rules for any firewall or gateway.
Before you start
- Admin access to your firewall
- A list of applications and who needs them
Step by step
Start from default deny
Block everything inbound and between zones, then allow only what is required.
Define zones
For example WAN, LAN, Servers, Guests, CCTV and Management, with clear rules between each pair.
Be specific
Use exact source, destination and service. Avoid 'any any any' rules.
Order rules carefully
Put specific rules before general ones, and keep a final explicit deny-and-log rule.
Restrict outbound too
Allow common business ports outbound and block risky services such as outbound SMB and Telnet.
Review regularly
Remove unused rules and check hit counts every quarter. Document the business reason for each rule.
Pro tips
- Never expose RDP, SSH or device admin pages directly to the Internet; use a VPN.
- Enable intrusion prevention and application control where available.
FAQ
Frequently asked questions
How often should firewall rules be reviewed?
At least quarterly, and after every major change in applications or suppliers.
Keep learning
Related guides
Site-to-site VPN
Read more →Navijin firewalls (Q1 2027)
Read more →How to Enable 802.1X Port Authentication on Switches
Stop unknown devices from using your network ports: configure 802.1X with RADIUS and MAC-authentication bypass for printers and cameras.
Read more →How to Secure the Management of Switches, Routers and Access Points
A hardening checklist for every network device: strong credentials, SSH only, a management VLAN, access lists and logging.
Read more →How to Segment IoT and CCTV Devices From Your Main Network
Put cameras, smart TVs, sensors and building systems in their own VLANs so one compromised device cannot reach your business systems.
Read more →Stuck on a step?
Ask Navijin technical support or an authorised partner for help with your configuration.