The scenario
Client (10.0.1.10) can reach Web Server (10.0.2.20) only through Firewall. Web Server runs three services: HTTP on TCP port 80, HTTPS on TCP port 443 and SSH on TCP port 22. Firewall has two rules: priority 10 allows TCP port 80 and priority 20 allows ICMP (ping). Anything no rule allows is dropped, so HTTPS and SSH are blocked even though Web Server is listening for them. Think of a front desk with a short guest list: if your name is not on it, you do not get in, however harmless you look.
What you will work out
Understand allow rules, the default-deny policy, rule priority, and how a stateful firewall lets replies back in.
Why this matters
Networks that host services filter them this way: a short list of what is allowed and a default that drops the rest. When an application cannot connect, the firewall is one of the first places to look, and a trace that shows which rule matched answers the question directly. Cloud platforms use the same idea; AWS security groups, for example, contain only allow rules, deny everything else, and are stateful like this firewall.
Running it
Firewall: Allow & Deny opens on a canvas, already wired and addressed. Trace a packet through it hop by hop, or run the same topology live on real Linux network namespaces. How the two modes differ.
Open Firewall: Allow & Deny
Runs in your browser. No install, no signup, and the simulation starts instantly.
Open the lab →