Firewall Configuration Task - Cybersecurity Internship

Task 4: Setup and Use a Firewall on Windows/Linux

Overview

This project demonstrates how to configure and manage firewall rules on both Windows and Linux systems. Firewalls are a fundamental security control that filters network traffic based on predefined rules, protecting systems from unauthorized access and malicious traffic.

⚠️ IMPORTANT: This is for educational purposes on systems you own. Always follow your organization's security policies before modifying firewall rules in production environments.

Objective

Configure and test basic firewall rules to allow or block specific network traffic, understanding how firewalls control inbound and outbound connections.

Tools Used

Windows Firewall (Windows Defender Firewall with Advanced Security)
- Built into Windows 10/11
- GUI and PowerShell interfaces
UFW (Uncomplicated Firewall) - Linux
- User-friendly interface for iptables
- Command-line based
- Default on Ubuntu/Debian systems
Testing Tools
- telnet - Test port connectivity
- netcat (nc) - Network testing
- nmap - Port scanning
- Test-NetConnection (PowerShell)

What's Included

Firewall configuration steps for Windows and Linux
Screenshots of firewall rules
Configuration files/command history
Test results showing rules in action
Interview questions with detailed answers
Best practices and troubleshooting guide

System Information

Operating System: [Your OS - Windows 11 / Ubuntu 22.04 / etc.] Firewall Tool: [Windows Firewall / UFW] Completion Date: [Date]

Part 1: Windows Firewall Configuration

Prerequisites

Windows 10/11 with Administrator access
Windows Defender Firewall enabled

Step 1: Open Windows Firewall

Method 1: GUI (Recommended for beginners)

1. Press Windows key + R
2. Type: wf.msc
3. Press Enter

Method 2: Control Panel

1. Control Panel → System and Security → Windows Defender Firewall
2. Click "Advanced settings" on left panel

Method 3: PowerShell (Admin)

# Open Windows Defender Firewall
Start-Process wf.msc

Screenshot: screenshots/01-windows-firewall-home.png

Step 2: View Current Firewall Rules

Using GUI:

1. In Windows Defender Firewall with Advanced Security
2. Click "Inbound Rules" (left panel)
3. View list of existing rules
4. Click "Outbound Rules" to see outbound rules

Using PowerShell:

# List all firewall rules
Get-NetFirewallRule | Select-Object DisplayName, Enabled, Direction, Action | Format-Table

# List only enabled inbound rules
Get-NetFirewallRule -Direction Inbound -Enabled True | Select-Object DisplayName, Action

# List only enabled outbound rules
Get-NetFirewallRule -Direction Outbound -Enabled True | Select-Object DisplayName, Action

# Count total rules
(Get-NetFirewallRule).Count

Screenshot: screenshots/02-windows-existing-rules.png

Step 3: Block Telnet (Port 23) - Inbound Traffic

Why Block Telnet?

Telnet transmits data in plaintext (including passwords)
Major security vulnerability
Replaced by SSH (encrypted)
Common attack vector

Using GUI:

1. Right-click "Inbound Rules" → New Rule
2. Rule Type: Select "Port" → Next
3. Protocol: TCP
4. Specific local ports: 23
5. Action: Select "Block the connection" → Next
6. Profile: Check all (Domain, Private, Public) → Next
7. Name: "Block Telnet (Port 23)"
8. Description: "Block insecure Telnet protocol"
9. Click "Finish"

Using PowerShell (Admin):

# Block inbound Telnet traffic on port 23
New-NetFirewallRule -DisplayName "Block Telnet (Port 23)" `
    -Direction Inbound `
    -Protocol TCP `
    -LocalPort 23 `
    -Action Block `
    -Profile Any `
    -Description "Block insecure Telnet protocol"

# Verify rule was created
Get-NetFirewallRule -DisplayName "Block Telnet (Port 23)"

Screenshot: screenshots/03-windows-block-telnet-rule.png

Step 4: Test the Telnet Block Rule

Test from same machine:

# Try to connect to localhost on port 23
Test-NetConnection -ComputerName localhost -Port 23

# Expected output:
# WARNING: TCP connect to (localhost : 23) failed
# TcpTestSucceeded : False

Using telnet (if installed):

# Enable telnet client first (run as admin):
dism /online /Enable-Feature /FeatureName:TelnetClient

# Try to connect
telnet localhost 23

# Expected: Connection fails or times out

Screenshot: screenshots/04-windows-telnet-test-blocked.png

Step 5: Allow SSH (Port 22) - Inbound Traffic

Using GUI:

1. Right-click "Inbound Rules" → New Rule
2. Rule Type: Select "Port" → Next
3. Protocol: TCP
4. Specific local ports: 22
5. Action: Select "Allow the connection" → Next
6. Profile: Check all (Domain, Private, Public) → Next
7. Name: "Allow SSH (Port 22)"
8. Description: "Allow secure SSH connections"
9. Click "Finish"

Using PowerShell:

# Allow inbound SSH traffic on port 22
New-NetFirewallRule -DisplayName "Allow SSH (Port 22)" `
    -Direction Inbound `
    -Protocol TCP `
    -LocalPort 22 `
    -Action Allow `
    -Profile Any `
    -Description "Allow secure SSH connections"

# Verify rule
Get-NetFirewallRule -DisplayName "Allow SSH (Port 22)"

Screenshot: screenshots/05-windows-allow-ssh-rule.png

Step 6: Create Outbound Block Rule (Example)

Block outbound HTTP traffic on port 80 (for testing):

# Block outbound HTTP traffic
New-NetFirewallRule -DisplayName "Block Outbound HTTP (Port 80)" `
    -Direction Outbound `
    -Protocol TCP `
    -RemotePort 80 `
    -Action Block `
    -Profile Any `
    -Description "Test rule: Block HTTP traffic"

Test the rule:

# Try to connect to a website on port 80
Test-NetConnection -ComputerName example.com -Port 80

# Expected: Connection should fail

Step 7: Remove Test Rules (Cleanup)

Using GUI:

1. Find your test rule in the list
2. Right-click the rule → Delete
3. Confirm deletion

Using PowerShell:

# Remove Telnet block rule
Remove-NetFirewallRule -DisplayName "Block Telnet (Port 23)"

# Remove SSH allow rule (if you don't need it)
Remove-NetFirewallRule -DisplayName "Allow SSH (Port 22)"

# Remove outbound HTTP block rule
Remove-NetFirewallRule -DisplayName "Block Outbound HTTP (Port 80)"

# Verify deletion
Get-NetFirewallRule -DisplayName "Block Telnet (Port 23)"
# Should return nothing

Step 8: Export Firewall Configuration

Export all firewall rules:

# Export to CSV
Get-NetFirewallRule | Select-Object DisplayName, Direction, Action, Enabled |
    Export-Csv -Path "firewall_rules_backup.csv" -NoTypeInformation

# Export specific rule details
Get-NetFirewallRule -DisplayName "Block Telnet (Port 23)" |
    Get-NetFirewallPortFilter |
    Format-List

Backup entire firewall policy:

# Export firewall policy (requires admin)
netsh advfirewall export "C:\firewall_backup.wfw"

# Restore firewall policy
# netsh advfirewall import "C:\firewall_backup.wfw"

Part 2: Linux Firewall Configuration (UFW)

Prerequisites

Linux system (Ubuntu/Debian recommended)
Root/sudo access
UFW installed

Step 1: Check UFW Status

# Check if UFW is installed
which ufw

# Check UFW status
sudo ufw status

# Detailed status with numbered rules
sudo ufw status numbered

# Check if UFW is active
sudo ufw status verbose

Expected Output:

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

Screenshot: screenshots/06-linux-ufw-status.png

Step 2: Enable UFW (if not already active)

# Enable UFW
sudo ufw enable

# WARNING: This may disrupt existing SSH connections
# Always allow SSH before enabling UFW on remote servers!

If you get locked out of SSH, connect via console and run:

sudo ufw allow 22/tcp
sudo ufw enable

Step 3: View Current UFW Rules

# List all rules
sudo ufw status numbered

# Show detailed rule information
sudo ufw show added

# View UFW configuration
sudo ufw show raw

# Check default policies
sudo ufw show builtins

Example Output:

Status: active

     To                         Action      From
     --                         ------      ----
[ 1] 22/tcp                     ALLOW IN    Anywhere
[ 2] 22/tcp (v6)                ALLOW IN    Anywhere (v6)

Screenshot: screenshots/07-linux-ufw-rules-list.png

Step 4: Block Telnet (Port 23) - Inbound

Block Telnet incoming connections:

# Block TCP port 23 (Telnet)
sudo ufw deny 23/tcp

# More specific rule with comment
sudo ufw deny 23/tcp comment 'Block insecure Telnet protocol'

# Verify rule was added
sudo ufw status numbered

Expected Output:

Rule added
Rule added (v6)

Screenshot: screenshots/08-linux-block-telnet.png

Step 5: Test the Telnet Block Rule

# Install telnet client if not present
sudo apt install telnet

# Try to connect to localhost on port 23
telnet localhost 23

# Expected: Connection refused or timeout

# Alternative test with netcat
nc -vz localhost 23

# Expected output:
# nc: connect to localhost port 23 (tcp) failed: Connection refused

Test from another machine:

# From another computer on the network
telnet [YOUR_IP] 23

# Should fail to connect

Screenshot: screenshots/09-linux-telnet-blocked.png

Step 6: Allow SSH (Port 22) - Inbound

# Allow SSH connections (if not already allowed)
sudo ufw allow 22/tcp

# Or use the service name
sudo ufw allow ssh

# More specific: allow SSH from specific IP only
sudo ufw allow from 192.168.1.100 to any port 22

# Allow SSH from specific subnet
sudo ufw allow from 192.168.1.0/24 to any port 22 proto tcp

# Verify
sudo ufw status numbered

Screenshot: screenshots/10-linux-allow-ssh.png

Step 7: Additional UFW Rule Examples

Block outbound traffic to specific port:

# Block outbound HTTP (port 80)
sudo ufw deny out 80/tcp comment 'Test: Block outbound HTTP'

# Test
curl -I http://example.com
# Should fail or timeout

Allow specific application:

# See available application profiles
sudo ufw app list

# Allow Apache web server
sudo ufw allow 'Apache Full'

# Allow Nginx
sudo ufw allow 'Nginx Full'

Allow port range:

# Allow ports 6000-6007
sudo ufw allow 6000:6007/tcp

# Allow UDP port range
sudo ufw allow 6000:6007/udp

Deny from specific IP:

# Block all traffic from IP
sudo ufw deny from 203.0.113.100

# Block specific IP to specific port
sudo ufw deny from 203.0.113.100 to any port 22

Step 8: Remove/Delete Rules

Method 1: By rule number

# List rules with numbers
sudo ufw status numbered

# Delete rule by number (e.g., rule #3)
sudo ufw delete 3

# Confirm deletion

Method 2: By rule specification

# Delete by repeating the rule with 'delete' keyword
sudo ufw delete deny 23/tcp

# Delete specific rule
sudo ufw delete allow from 192.168.1.100 to any port 22

Remove all rules and reset:

# WARNING: This removes ALL rules and disables UFW
sudo ufw reset

# Re-enable after reset
sudo ufw enable

Step 9: UFW Logging and Monitoring

# Enable logging
sudo ufw logging on

# Set logging level (low, medium, high, full)
sudo ufw logging medium

# View UFW logs
sudo tail -f /var/log/ufw.log

# View only blocked packets
sudo grep '\[UFW BLOCK\]' /var/log/ufw.log

# View recent blocks
sudo tail -n 50 /var/log/ufw.log | grep BLOCK

Step 10: UFW Default Policies

# View current default policies
sudo ufw status verbose

# Set default deny for incoming
sudo ufw default deny incoming

# Set default allow for outgoing
sudo ufw default allow outgoing

# Set default deny for routed traffic
sudo ufw default deny routed

# Recommended default configuration:
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw default deny routed

Configuration Files

Windows Firewall

PowerShell Commands Used:

# Save to: config/windows-firewall-commands.ps1

# List all commands used
Get-NetFirewallRule | Export-Csv firewall-rules.csv

# Block Telnet
New-NetFirewallRule -DisplayName "Block Telnet (Port 23)" `
    -Direction Inbound -Protocol TCP -LocalPort 23 -Action Block

# Allow SSH
New-NetFirewallRule -DisplayName "Allow SSH (Port 22)" `
    -Direction Inbound -Protocol TCP -LocalPort 22 -Action Allow

# Test connection
Test-NetConnection -ComputerName localhost -Port 23
Test-NetConnection -ComputerName localhost -Port 22

Linux UFW

Command History:

# Save to: config/linux-ufw-commands.sh

# Check status
sudo ufw status numbered

# Block Telnet
sudo ufw deny 23/tcp

# Allow SSH
sudo ufw allow 22/tcp

# Test
telnet localhost 23
nc -vz localhost 22

# Cleanup
sudo ufw delete deny 23/tcp

UFW Configuration File:

# View UFW config
cat /etc/ufw/ufw.conf

# View default rules
cat /etc/default/ufw

# Backup UFW rules
sudo cp -r /etc/ufw /etc/ufw.backup

How Firewall Filters Traffic

Packet Filtering Process

1. PACKET ARRIVES at network interface
         ↓
2. FIREWALL INSPECTS packet headers:
   - Source IP address
   - Destination IP address
   - Source port number
   - Destination port number
   - Protocol (TCP/UDP/ICMP)
   - Direction (inbound/outbound)
         ↓
3. FIREWALL MATCHES against rules (top to bottom)
         ↓
4. FIRST MATCHING RULE determines action:
   - ALLOW: Packet passes through
   - DENY/BLOCK: Packet dropped silently
   - REJECT: Packet dropped, notification sent
         ↓
5. DEFAULT POLICY applied if no match:
   - Usually: Deny incoming, Allow outgoing

Example Packet Flow

Scenario: Web browser connecting to website on port 80

Outbound Request:
----------------
Source: Your PC (192.168.1.100:54321)
Destination: Web server (93.184.216.34:80)
Protocol: TCP
Direction: OUTBOUND

Firewall checks outbound rules:
→ No specific block rule for port 80 outbound
→ Default policy: ALLOW outgoing
→ RESULT: Packet allowed ✓

Inbound Response:
-----------------
Source: Web server (93.184.216.34:80)
Destination: Your PC (192.168.1.100:54321)
Protocol: TCP
Direction: INBOUND

Firewall checks:
→ Is this part of established connection? YES (stateful inspection)
→ RESULT: Response allowed ✓ (related to allowed outbound connection)

Stateful vs Stateless Filtering

Stateful Firewall (Default in Windows & UFW):

- Tracks connection state (NEW, ESTABLISHED, RELATED)
- Remembers outbound requests
- Automatically allows related inbound responses
- More intelligent and secure
- Example: You request a web page, response is auto-allowed

Stateless Firewall:

- Each packet judged independently
- No connection memory
- Requires explicit rules for both directions
- Faster but less intelligent
- Example: Must explicitly allow both request AND response

Testing & Verification

Test 1: Verify Telnet is Blocked

Windows:

# Should fail
Test-NetConnection -ComputerName localhost -Port 23
telnet localhost 23

Linux:

# Should be refused
telnet localhost 23
nc -vz localhost 23

Expected Result: Connection refused/failed ✓

Test 2: Verify SSH is Allowed

Windows:

# Should succeed (if SSH server running)
Test-NetConnection -ComputerName localhost -Port 22

Linux:

# Should connect (if SSH server running)
nc -vz localhost 22
ssh localhost

Expected Result: Connection successful ✓

Test 3: Port Scan Before and After

Using nmap:

# Install nmap
# Windows: Download from nmap.org
# Linux: sudo apt install nmap

# Scan before firewall rules
nmap -sT localhost -p 22,23,80,443

# Expected: Multiple ports open

# Apply firewall rules

# Scan after firewall rules
nmap -sT localhost -p 22,23,80,443

# Expected: Port 23 filtered/closed

Screenshots Checklist

Required screenshots to include:

Optional but recommended:

Before/after port scan comparison
Firewall logs showing blocked traffic
GUI screenshots showing rule properties

Common Firewall Mistakes

1. Blocking Yourself Out (SSH/RDP)

Mistake:

# On remote server via SSH
sudo ufw enable  # Without allowing SSH first
# You're now locked out!

Prevention:

# ALWAYS allow SSH before enabling firewall
sudo ufw allow 22/tcp
sudo ufw enable

2. Wrong Rule Order

Mistake:

# Block all traffic from IP
sudo ufw deny from 192.168.1.100

# Then try to allow SSH from same IP
sudo ufw allow from 192.168.1.100 to any port 22

# Won't work! Deny rule processed first

Fix:

# Specific rules should come BEFORE general rules
sudo ufw delete deny from 192.168.1.100
sudo ufw allow from 192.168.1.100 to any port 22

3. Forgetting IPv6

Mistake:

# Only blocking IPv4
sudo ufw deny from 192.168.1.100

# Attacker uses IPv6 → not blocked!

Fix:

# UFW automatically creates IPv6 rules
# But verify:
sudo ufw status numbered
# Should see both (v4) and (v6) rules

4. Too Permissive Default Policy

Mistake:

# Allowing all incoming by default
netsh advfirewall set allprofiles firewallpolicy allowinbound,allowoutbound

Recommended:

# Deny incoming, allow outgoing (default)
netsh advfirewall set allprofiles firewallpolicy blockinbound,allowoutbound

5. Not Testing Rules

Mistake:

Create rule → Don't test → Assume it works

Best Practice:

1. Create rule
2. Test with telnet/nc/Test-NetConnection
3. Verify with port scan
4. Check firewall logs
5. Test from external network

6. Leaving Test Rules Active

Mistake:

Create test rules → Forget to delete → Leave security holes

Best Practice:

- Document all test rules
- Delete immediately after testing
- Use temporary rules if supported
- Regular firewall audits

Best Practices

Security Best Practices

Default Deny Policy

Default: Deny all incoming
Explicitly allow only necessary services

Principle of Least Privilege

Only open ports that are actively needed
Close unused ports
Restrict by source IP when possible

Regular Audits

# Review rules monthly
sudo ufw status numbered
# Remove unused rules

Enable Logging

# UFW
sudo ufw logging medium

# Windows
# Enable logging in firewall properties

Use Strong Rules

# Instead of allowing from anywhere:
# sudo ufw allow 22/tcp

# Allow from specific subnet only:
sudo ufw allow from 192.168.1.0/24 to any port 22

Document Everything

- Keep changelog of firewall modifications
- Document business justification for each rule
- Include rule descriptions/comments

Troubleshooting

Issue 1: UFW command not found (Linux)

Solution:

# Install UFW
sudo apt update
sudo apt install ufw

# Or on Fedora/CentOS
sudo yum install ufw

Issue 2: Windows Firewall rule not working

Checklist:

Rule is enabled (check "Enabled" column)
Rule applies to correct profile (Domain/Private/Public)
No conflicting rule with higher priority
Service is actually running on that port
Windows Firewall service is running

Verify:

# Check if firewall is on
Get-NetFirewallProfile | Select-Object Name, Enabled

# Check rule details
Get-NetFirewallRule -DisplayName "Your Rule" | Format-List

# Restart firewall service
Restart-Service mpssvc

Issue 3: Can't connect to localhost

Possible Causes:

Service not running on that port
Firewall blocking localhost connections
Application listening on specific IP only

Diagnosis:

# Check what's listening
# Windows:
netstat -an | findstr :22

# Linux:
sudo netstat -tulpn | grep :22
sudo ss -tulpn | grep :22

Issue 4: UFW blocks everything after enabling

Solution:

# Disable UFW temporarily
sudo ufw disable

# Allow necessary services
sudo ufw allow 22/tcp  # SSH
sudo ufw allow 80/tcp  # HTTP
sudo ufw allow 443/tcp # HTTPS

# Re-enable
sudo ufw enable

Summary

What We Accomplished

✅ Learned firewall basics - Understanding packet filtering ✅ Configured Windows Firewall - Created inbound/outbound rules ✅ Configured Linux UFW - Managed rules via command line ✅ Blocked Telnet (port 23) - Demonstrated blocking insecure protocol ✅ Allowed SSH (port 22) - Enabled secure remote access ✅ Tested rules - Verified firewall functionality ✅ Cleaned up - Removed test rules ✅ Documented process - Commands and screenshots

Key Concepts Learned

Firewalls filter network traffic based on rules
Inbound rules control incoming connections
Outbound rules control outgoing connections
Port numbers identify services (22=SSH, 23=Telnet, 80=HTTP)
Default deny is more secure than default allow
Stateful firewalls track connection state
Rule order matters - first match wins
Testing is crucial - always verify rules work

Real-World Applications

Server hardening - Block unnecessary ports
Network segmentation - Control inter-VLAN traffic
Compliance - Meet PCI-DSS, HIPAA requirements
Threat mitigation - Block known malicious IPs
Access control - Restrict admin access to specific IPs

Next Steps

Explore advanced rules - Rate limiting, connection tracking
Learn iptables - More powerful Linux firewall
Study network protocols - TCP/IP, UDP, ICMP
Practice with scenarios - Simulate real-world use cases
Setup IDS/IPS - Complement firewall with intrusion detection

Files Included

firewall-configuration-task/
├── README.md                          # This file
├── INTERVIEW_QUESTIONS.md             # Detailed Q&A
├── screenshots/
│   ├── 01-windows-firewall-home.png
│   ├── 02-windows-existing-rules.png
│   ├── 03-windows-block-telnet-rule.png
│   ├── 04-windows-telnet-test-blocked.png
│   ├── 05-windows-allow-ssh-rule.png
│   ├── 06-linux-ufw-status.png
│   ├── 07-linux-ufw-rules-list.png
│   ├── 08-linux-block-telnet.png
│   ├── 09-linux-telnet-blocked.png
│   └── 10-linux-allow-ssh.png
└── config/
    ├── windows-firewall-commands.ps1
    ├── linux-ufw-commands.sh
    └── firewall-rules-backup.csv

Resources

Completed by: [Your Name] Date: [Completion Date] Platform: [Windows 11 / Ubuntu 22.04 / Both]

Stay secure! 🔥🛡️

Name		Name	Last commit message	Last commit date
01.png		01.png
02.png		02.png
INTERVIEW_QUESTIONS.md		INTERVIEW_QUESTIONS.md
README.md		README.md

Latest commit

History

Folders and files

Repository files navigation

Firewall Configuration Task - Cybersecurity Internship

Task 4: Setup and Use a Firewall on Windows/Linux

Overview

Objective

Tools Used

What's Included

System Information

Part 1: Windows Firewall Configuration

Prerequisites

Step 1: Open Windows Firewall

Step 2: View Current Firewall Rules

Step 3: Block Telnet (Port 23) - Inbound Traffic

Step 4: Test the Telnet Block Rule

Step 5: Allow SSH (Port 22) - Inbound Traffic

Step 6: Create Outbound Block Rule (Example)

Step 7: Remove Test Rules (Cleanup)

Step 8: Export Firewall Configuration

Part 2: Linux Firewall Configuration (UFW)

Prerequisites

Step 1: Check UFW Status

Step 2: Enable UFW (if not already active)

Step 3: View Current UFW Rules

Step 4: Block Telnet (Port 23) - Inbound

Step 5: Test the Telnet Block Rule

Step 6: Allow SSH (Port 22) - Inbound

Step 7: Additional UFW Rule Examples

Step 8: Remove/Delete Rules

Step 9: UFW Logging and Monitoring

Step 10: UFW Default Policies

Configuration Files

Windows Firewall

Linux UFW

How Firewall Filters Traffic

Packet Filtering Process

Example Packet Flow

Stateful vs Stateless Filtering

Testing & Verification

Test 1: Verify Telnet is Blocked

Test 2: Verify SSH is Allowed

Test 3: Port Scan Before and After

Screenshots Checklist

Common Firewall Mistakes

1. Blocking Yourself Out (SSH/RDP)

2. Wrong Rule Order

3. Forgetting IPv6

4. Too Permissive Default Policy

5. Not Testing Rules

6. Leaving Test Rules Active

Best Practices

Security Best Practices

Troubleshooting

Issue 1: UFW command not found (Linux)

Issue 2: Windows Firewall rule not working

Issue 3: Can't connect to localhost

Issue 4: UFW blocks everything after enabling

Summary

What We Accomplished

Key Concepts Learned

Real-World Applications

Next Steps

Files Included

Resources

Official Documentation

Learning Resources

Tools

About

Resources

Stars

Watchers

Forks

Releases

Packages

Contributors