Network › Module 1 › Lesson 1
What a Firewall Is (Packet Policy)
A firewall is policy on packets — then YOUR host.
Visual · firewall_packet_policy
Firewall = allow/deny policy on packets. Original Cyberlium.
Opening
A firewall is not a brand sticker. It is a policy that says which packets may pass.
Network security starts with a boring sentence: every packet is either allowed, denied, or never classified (which usually means allowed by accident). A firewall is the place that policy is supposed to live. It is not antivirus, not a VPN, and not a promise that the human behind the packet is trustworthy. This is ORIGINAL Cyberlium Topic 11 teaching — not a vendor cert, not a café-Wi-Fi hardening kit, not a warrant to reconfigure someone else's gateway.
1. Policy first: allow, deny, or forgotten default
A packet has a source, a destination, a protocol, and usually a port. Firewall policy asks: given those facts, may this packet enter, leave, or be forwarded? Three answers matter. Allow means the policy named that flow. Deny means the policy named it and refused it. Forgotten default means nobody named it — and many devices fail open toward “sure, pass it.” That last case is how printers, guest laptops, and forgotten admin ports stay reachable. Cyberlium wording: write the intended flows first, then make everything else a deny. Fancy next-gen labels do not replace that sentence. A “smart” firewall with an empty mental model is still a router with opinions.
Command guide
Policy first: allow, deny, or forgotten default
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install iptables sudo apt install ufw
macOS: Use pfctl (built-in)
Windows: Use: netsh advfirewall
═══ LINUX / macOS ═══
View current firewall rules
Command — copy this
sudo iptables -L -n -v sudo iptables -L --line-numbers
UFW (simpler frontend)
Command — copy this
sudo ufw status verbose sudo ufw enable sudo ufw default deny incoming sudo ufw default allow outgoing sudo ufw allow 22/tcp
═══ WINDOWS ═══
Windows Firewall
Command — copy this
netsh advfirewall show allprofiles netsh advfirewall firewall show rule name=all
Optional command
PowerShell
Command — copy this
Get-NetFirewallRule | Where-Object {$_.Enabled -eq 'True'} | Select-Object DisplayName, Direction, Action | Format-Table2. What a firewall can see — and what it cannot
A simple packet filter sees IPs, ports, and flags. It does not know if the HTTP on 443 is your bank or malware. Application-aware boxes claim to see more — hostnames, categories, sometimes users — but they still enforce a policy you (or a vendor default) wrote. Encrypted payloads stay opaque unless you intercept TLS on a path you are authorized to intercept, which this course will not teach against strangers. On YOUR machine, the useful view is: inbound to services you did not mean to publish, and outbound you did not mean to allow. Topic 11 stays on that host view. Café packet capture kits and “bypass the school firewall” blogs are out.
3. Identify DEMO, then stay on YOUR host
The writeup URL http://192.168.0.1/ is a lab app YOU own. On many home networks that address is a router login instead. Identify with curl. Router Admin means STOP. Teaching bind stays Notes live under $HOME/cyberlium-lab, chmod 600. You are not “testing” a neighbor's firewall. You are learning to name policy on a host you control.
4. What you ship: named flows, deny the rest, bind loopback for labs
Shipping list: write intended inbound/outbound flows; default deny on hosts you administer; never publish teaching labs on 0.0.0.0; before treating it as a lab app; keep notes chmod 600. A firewall rule that “opens 22 to the world for class” is not a lab — it is a gift to scanners.
5. What you record before the next lesson
Date (UTC). Firewall = packet policy (allow/deny/forgotten-default). DEMO identified or STOPPED if router. SAFE NEVER nmap the LAN, hydra, or 0.0.0.0 bind. Path: $HOME/cyberlium-lab/t11-m01-l01-firewall-policy.txt. Legal: original Cyberlium — not a vendor firewall cert.
6. Wrong vs right: stranger networks vs literacy on systems you own
Worked failure — same network word, opposite target. Right never needs a café or campus LAN.
Wrong
Log into the home router because 192.168.0.1 answered. nmap 192.168.0.0/24 to “see who has ports.” Disable Windows Firewall “so the lab works.” Bind python to 0.0.0.0 on café Wi-Fi.
Right
with curl. Read YOUR host firewall profiles. Write allow/deny/forgotten-default in cyberlium-lab, chmod 600. Next: Host Firewalls vs Network Firewalls.
Mission: name packet policy on YOUR host
1) curl http://192.168.0.1/ and decide lab-app vs router (STOP if router). 2) Write allow / deny / forgotten-default in $HOME/cyberlium-lab. 3) Note one inbound flow YOUR PC should not publish. Never scan the LAN. Never reconfigure someone else's gateway.
Stuck? Ask Cyberlium AI Mentor
If ufw/Windows Firewall commands fail, ask Mentor: “Hint only: show MY firewall profile on this OS?” — not how to disable a school firewall.
Knowledge Check
APPLY: curl http://192.168.0.1/ shows a TP-Link “Router Admin” page. What do you do?
Multiple choice
Knowledge Check
APPLY: True or False: A firewall always knows the human identity behind a packet.
True or False
Knowledge Check
APPLY: Forgotten default on a host firewall usually means:
Multiple choice