Ethical › Module 12 › Lesson 4
Lab — Write Firewall Rules for YOUR Lab VM
Document inbound allow for SSH/HTTP you need; default deny notes.
Visual · firewall_lab_rules
A VM or box YOU own (or a labeled hypothetical you own): inbound allow only for SSH/HTTP you need, default deny, no needless 0.0.0.0. firewall-lab-notes.txt chmod 600.
Opening
You name the box. You write inbound allow for the two doors you actually need. You default-deny the rest. You lock the notes. That is the whole firewall lab.
Lessons 1–3 named policy, sensors, and tripwires without a bypass cookbook. This lab is the hands that match “configure YOUR lab firewall”: you will fill $HOME/cyberlium-lab/firewall-lab-notes.txt for a VM or computer THE USER OWNS — or a hypothetical clearly labeled as yours if you cannot change a live firewall today. Inbound allow lists SSH and/or HTTP(S) only if you actually need them. Default deny inbound is the rest. You will not expose 0.0.0.0 needlessly. You will chmod 600. You will not punch a café gateway, fragment past campus IPS, decoy-scan a sensor, or poke someone else’s honeypot. If this is a locked-down work PC you must not reconfigure, write that honestly and complete the lab as a labeled hypothetical you own (“lab-vm-01 I would create”). Do not “borrow” a school edge. Empty notes fail. Notes that contain other people’s rule IDs, nmap hide flags, or a neighbor’s WAN IP as a target fail ethics even if you enabled a host firewall on your laptop. Next is Quiz — Firewalls and Detection, then Module 13 talks what a web server exposes on a stack YOU run. This lab does not unlock an evasion kit. It unlocks a mode-600 file that says you designed inbound policy for a box you own.
1. Lab surface: YOUR VM/box, or a hypothetical labeled as yours
Pick a machine whose packets you may govern: the laptop you are sitting at if you own it, a hypervisor guest you created, a home-lab router whose admin you are. “Own” means you may change host-firewall settings without asking a school, employer, café, or roommate. Work MDM that forbids local firewall edits is a skip-with-reason, not a license to reimage a kiosk. A hypothetical is allowed when you cannot apply live rules: still name the would-be hostname, the hypervisor, and the inbound lines you would write. Do not substitute “the campus ASA” as your hypothetical. Do not document a roommate’s WAN as the allow source because it was convenient.
You may READ current host-firewall status on THAT box as inventory — Windows Defender Firewall profiles, ufw status, nft/iptables list on a Linux VM you created — the same Settings-you-may-open rule as Module 6 and 7 labs. Reading is not punching. Applying an inbound allow on YOUR box is building. Applying an inbound allow on a device you do not administer is out. This lab never needs a second host. It never needs nmap against anyone. It never needs a decoy address.
Command guide
YOUR VM or labeled hypothetical — WHAT/WHY
═══ COMMANDS ═══
Command — copy this
cat > "$NOTES" << 'EOF' === FIREWALL LAB (Cyberlium M12 L04) === ASSET: (MY VM / hypothetical I own) INBOUND_ALLOW: (e.g. 127.0.0.1:8000 from me only — fill) DEFAULT_DENY: Y OUTBOUND: (separate column — fill) ETHICS: not cafe/campus/neighbor gateway EOF
2. Inbound allow: only SSH/HTTP you actually need — name the source
Inbound is traffic toward a port on YOUR box. For many teaching VMs the honest list is short. SSH (22/tcp) if you administer the guest from another machine YOU own — prefer a host-only or NAT network, or a single admin source, not “from anywhere.” HTTP (80/tcp) or HTTPS (443/tcp) if you still run a teaching listener you started and you have a reason it is not loopback-only (Module 4 preferred 127.0.0.1). If you do not need SSH from another host, write “SSH inbound: none — I use the hypervisor console.” If you do not need HTTP inbound from the LAN, write “HTTP: loopback only / not published.” Need is a sentence, not a vibe.
0.0.0.0/0 (or “Any” in a GUI) as an inbound source means the whole internet may knock if the VM is reachable. That is how leftover SSH becomes Module 10 botnet food. This lab forbids needless any-source allow. If you truly cannot name a tighter source (a cloud lab with a changing home IP), write the residual risk, the owner (you), and a revisit date — Module 5 accept-with-owner, not a shrug. Prefer: hypervisor host-only, a /32 you control, a VPN interface you run. Do not publish 22 to the world “so the class Discord can SSH in and grade me.” Discord is not your allow list.
Command guide
Inbound allow only what you need — WHAT/WHY
═══ INSTALL ═══
Linux (Debian/Ubuntu): Built-in (iproute2)
macOS: Use: netstat
Windows: Use: netstat
═══ COMMANDS ═══
Command — copy this
ss -ltn || netstat -ltn
3. Default deny, bind cousins, and outbound as a separate column
Default deny inbound means: unless a line explicitly allows it, inbound is dropped or rejected. Write that as the first policy sentence, then the exceptions. Outbound may stay allowed for a workstation so YOUR browser works; still write the column so you did not pretend inbound and outbound are the same knob. Binding remains a cousin: a daemon on 127.0.0.1 plus default deny is defense in depth. A daemon on 0.0.0.0 plus a host firewall that only allows your LAN is a documented choice, not an accident. A daemon on 0.0.0.0 plus no firewall plus any-source 22 is the failure mode this lab exists to kill.
Windows users: note the profile (Domain/Private/Public) you actually use on a machine you own, and whether inbound is blocked by default in that profile. Linux users: note ufw default incoming deny, or the nft/filter input policy on a VM you created. You are documenting intended policy. If you apply a change, apply it only on YOUR box, then re-read status into the notes. Do not paste a “one-liner to disable Windows Firewall so nmap works.” Disabling YOUR firewall to make a scan prettier is the Lesson 2 mute-the-camera failure in host form.
4. What to write: machine, allow rows, default deny, 0.0.0.0 note, ethics
Required rows: (1) legal — original Cyberlium teaching mapped to the CEH v13 IDS/firewall/honeypot domain — not official EC-Council training, not a cert, not exam dumps. (2) machine_i_own — hostname you share with yourself, or “hypothetical lab-vm-01,” not a campus asset tag. (3) default_deny_inbound — yes, in your words. (4) inbound_allow — SSH and/or HTTP(S) with port, source, and why; or honest none. (5) no_needless_0000 — sentence that any-source was refused or justified with owner+date. (6) bind_cousin — loopback vs LAN vs 0.0.0.0 for any teaching HTTP. (7) lockdown — you did not leave a wide hole; you did not disable the host firewall to “make CEH easier.” (8) ethics — no punch, no nmap decoys/fragments/timing to hide, no someone else’s honey. chmod 600 on the notes and the helper.
Forbidden rows: evasion steps, fragment recipes, decoy IP lists, campus rule IDs, café gateway tricks, honeypot raid notes, “ufw disable,” Metasploit titled as firewall testing. If a sentence would help bypass a wall you do not own, delete it. If a sentence would help future-you keep YOUR VM from facing the café, keep it. Failure modes that still pass if you tell the truth: cannot apply live ufw on a managed PC — hypothetical rows filled. Port 80 unused — write none. Failure modes that fail the course: success against school.edu, notes chmod 644 on a shared PC with punch commands, 0.0.0.0/0 SSH “for convenience.”
5. Wrong vs right: punching a stranger vs documenting default deny on YOUR VM
Worked failure — same word “firewall rules,” opposite owner. Right never needs a second organization’s edge when YOUR VM can have a policy file.
Wrong
nmap decoys/fragments/timing to hide. Punch café/campus/roommate. Allow 22 from 0.0.0.0/0 needlessly. Disable the host firewall so a scan looks open. Raid a honeypot. Skip chmod. Call the lab incomplete without an evasion screenshot. This course is not official CEH training and does not grade that hunt.
Right
Document inbound allow for SSH/HTTP you need on a VM/box YOU own (or labeled hypothetical). Default deny. No needless 0.0.0.0. Fill firewall-lab-notes.txt, chmod 600 under $HOME/cyberlium-lab. No punch. No decoys. Next: Quiz — Firewalls and Detection.
6. Optional status read on YOUR box only — inventory, not a punch
If and only if you own the machine, you may record a status snapshot: Windows `netsh advfirewall show allprofiles` in YOUR profile, or `ufw status verbose` / `sudo nft list ruleset` on a Linux VM you created. Copy summaries into the notes, not into Discord. If a command wants a password you do not have, stop — that is a managed PC; switch to hypothetical rows. Do not run these against a host over SSH you do not own. Do not add nmap to “verify from the outside” against a public IP you do not control. Verification of YOUR policy is reading YOUR firewall, not scanning the planet.
Windows without chmod: WSL/Git Bash, or restrict the files in your profile. Record which OS you used so the notes are reproducible on YOUR box. Stop. That is the whole optional extra. There is no Terminal B that aims at a stranger.
7. Hands-on: write firewall-lab-notes.txt, check keys, chmod 600
Follow the block on a computer you own. Fill blanks from policy you intend (and status you are allowed to read). Run the checker; it only reads YOUR file. chmod 600. Do not add a campus ACL because the file felt short.
Mission: firewall-lab-notes.txt — YOUR inbound allow, chmod 600
1) On a VM/box YOU own (or a labeled hypothetical you own), document default deny inbound and allow rows for SSH/HTTP you actually need, with a named source — not needless 0.0.0.0. 2) Fill $HOME/cyberlium-lab/firewall-lab-notes.txt; run the checker; chmod 600. 3) Ethics: no punch, no nmap decoys/fragments/timing to hide, no someone else’s honeypot, do not disable YOUR host firewall to make a scan prettier.
Stuck? Ask Cyberlium AI Mentor
If “the lab is incomplete without sneaking a packet past a filter” still feels true, ask for a hint — not a punch line. Try: "Hint only: why inbound allow for SSH/HTTP I need plus default deny on a VM I own is the whole firewall lab, why 0.0.0.0 is needless, why notes need chmod 600, and why decoys/fragments/others' honey fail ethics?" You still fill the file. No campus ACL. No ufw disable.
You named a box you own, wrote inbound allow only for doors you need, default-denied the rest, refused needless 0.0.0.0, and locked the file. That is authorized firewall literacy as Cyberlium teaches it — original, not an exam dump, not EC-Council lab text. Next — Quiz — Firewalls and Detection — ten APPLY items on policy, signatures vs anomalies, tripwires, and the ethics line. Then Module 13: What a Web Server Exposes on a stack YOU run — still no random hosts, still no bypass cookbook.
Knowledge Check
APPLY: You documented inbound 22 from your host-only adapter and HTTP loopback-only on a VM you created. What did the lab demonstrate, and what must you do next?
Multiple choice
Knowledge Check
APPLY: True or False: If you cannot change a managed PC firewall, the ethical completion is to punch the campus edge instead of writing a labeled hypothetical you own.
True or False
Knowledge Check
APPLY: Which note file pairing matches this lab’s ethics and hygiene?
Multiple choice
Knowledge Check
APPLY: curl of http://192.168.0.1/ shows a home router login (TP-Link / Netgear / Huawei / "Router Admin"). Is that DEMO in scope as a hacking target?
Multiple choice