The scenario
Client (10.0.1.10) should reach Server (10.0.2.10) on HTTP (TCP port 80) and be able to ping it. Firewall has the right allow rules: TCP port 80 at priority 10 and ICMP at priority 20. It also has a deny-all rule (any protocol, any address) at priority 1. A lower number is checked first, and the first rule that matches decides, so every packet is denied at priority 1 and the allow rules are never reached. Server is listening on HTTP and SSH; nothing gets through to either.
What you will work out
Understand first-match rule evaluation, and why a broad deny must come after the specific allows.
Why this matters
A rule in the wrong place is one of the most common reasons a change that 'should have worked' does nothing: the allow is there, it simply never matches. Reading the rules in the order the device evaluates them, top to bottom, is the fastest way to find it. The same habit applies to iptables, Cisco ACLs and AWS network ACLs; AWS security groups, which have no order, are the one place it does not.
Running it
I Added Allow But Still Blocked opens on a canvas, already wired and addressed. Trace a packet through it hop by hop, or run the same topology live on real Linux network namespaces. How the two modes differ.
Open I Added Allow But Still Blocked
Runs in your browser. No install, no signup, and the simulation starts instantly.
Open the lab →