Network › Module 1 › Lesson 4
Lab — Host Firewall Check on Your PC
Prove YOUR host firewall is on, then curl — DEMO
Visual · t11_firewall_host_lab
Lab: Read YOUR firewall profiles. Teaching bind never 0.0.0.0.
Opening
Read the box you can actually change. Then prove loopback still answers on a port YOU started.
Lessons 1–3 named packet policy, host vs path, and default deny. This lab is the proof on a computer you control: (1) and STOP if it is a home router login, (2) print YOUR host firewall profiles without disabling them, (3) start a teaching listener bound only to , (4) curl it, (5) lock notes under $HOME/cyberlium-lab chmod 600. Original Cyberlium. You will not disable Windows Firewall “so the screenshot looks open.” You will not ufw allow 22/tcp from anywhere. You will not bind 0.0.0.0. You will not nmap the LAN. Next: Quiz — Firewalls.
1. Lab contract: identify DEMO, then YOUR profiles
GATE first. curl http://192.168.0.1/ — if TP-Link/Netgear/Huawei “Router Admin,” STOP. The rest of the lab is THIS OS firewall plus
Host firewall status is a read. If the command fails, write “command not found” — do not disable a filter to make the lab prettier.
Command guide
Lab contract: identify DEMO, then YOUR profiles
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install ufw sudo apt install dnsutils
macOS: Use pfctl (built-in)
Windows: Use: netsh advfirewall Use nslookup (built-in)
═══ COMMANDS ═══
Command — copy this
(sudo -n ufw status verbose ) || ufw status powershell.exe -NoProfile -Command "Get-NetFirewallProfile | Select-Object Name,Enabled | Format-Table -AutoSize"
2. Start a loopback listener YOU own
The teaching server must hardcode HOST="127.0.0.1". If a snippet says 0.0.0.0, refuse it. Run it in a second terminal. Ctrl+C when finished.
Command guide
Start a loopback listener YOU own
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
cat > "$HOME/cyberlium-lab/t11_fw_lab.py" << 'PY'
from http.server import BaseHTTPRequestHandler, HTTPServer
HOST = "127.0.0.1"
PORT = 8780
if HOST != "127.0.0.1":
raise SystemExit("refusing non-loopback bind")
class H(BaseHTTPRequestHandler):
def log_message(self, fmt, *args):
print("[t11-fw]", fmt % args)
def do_GET(self):
body = b"Cyberlium T11 firewall lab. bind=127.0.0.1:8780
policy=named loopback allow
"
self.send_response(200)
self.send_header("Content-Type", "text/plain; charset=utf-8")
self.send_header("X-Cyberlium-Lab", "t11-fw")
self.send_header("Content-Length", str(len(body)))
self.end_headers()
self.wfile.write(body)
print("bind", HOST, PORT)
HTTPServer((HOST, PORT), H).serve_forever()
PY3. curl SAFE, then lock the proof
curl -sS -m 3 -D - http:/// and save headers. That is the allow path you named. Stop the Python process when done. Do not leave a listener bound anywhere but loopback.
Command guide
curl SAFE, then lock the proof
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ COMMANDS ═══
Command — copy this
curl -sS -m 3 -D - "$SAFE/" -o "$HOME/cyberlium-lab/t11-m01-l04.body" | head -n 20 grep -n "127.0.0.1" "$HOME/cyberlium-lab/t11_fw_lab.py" | head grep -n "0.0.0.0" "$HOME/cyberlium-lab/t11_fw_lab.py" && echo "FIX: 0.0.0.0 is not allowed"
4. What you ship: profiles read, loopback proved, firewall still on
Host firewall still enabled. Listener was Notes chmod 600. DEMO identified or STOPPED. No 22/tcp from anywhere.
5. What you record before the next lesson
Date. Profiles listed. curl SAFE headers saved. NEVER disable the firewall, NEVER 0.0.0.0, NEVER nmap/hydra. File t11-m01-l04-firewall-lab.txt.
6. Wrong vs right: stranger networks vs literacy on systems you own
Worked failure — same network word, opposite target. Right never needs a café or campus LAN.
Wrong
Turn off Windows Firewall so port 8780 “works on Wi-Fi.” python -m http.server --bind 0.0.0.0. nmap 192.168.0.0/24 to compare other hosts.
Right
Read YOUR profiles. Start curl it. Leave the host firewall on. Next: Quiz — Firewalls.
Mission: host firewall read + loopback curl
1) / STOP if router. 2) Print YOUR firewall profiles (do not disable). 3) Start t11_fw_lab.py on and curl it. 4) Stop the process. chmod 600 notes.
Stuck? Ask Cyberlium AI Mentor
If Python is missing, ask Mentor for a PATH hint — not for exposing the lab to a phone on café Wi-Fi.
Knowledge Check
APPLY: The lab helper says HTTPServer(("0.0.0.0", 8780)). What do you do?
Multiple choice
Knowledge Check
APPLY: True or False: You should disable Windows Firewall so the Cyberlium lab port opens.
True or False
Knowledge Check
APPLY: curl http://192.168.0.1/ is TP-Link Router Admin during the firewall lab. Next?
Multiple choice