Network Security · Topic 7 of 7
ACLs, Firewalls and Security Zones
Apply ACLs, stateless and stateful firewalls, URL and content filtering, IDS and IPS, and trusted, untrusted and screened subnet zones to control traffic.
- 5 min
- Includes a diagram
- ACL rules are checked in order, the first match wins, and an implicit deny ends the list.
- Put specific rules before general rules.
- A stateful firewall tracks connections and allows return traffic. A stateless filter does not.
What it is
Security rules decide which traffic may cross which boundary. An access control list (ACL) is a list of permit and deny rules, and a firewall enforces rules on traffic between zones.
The exam asks you to read a rule set, pick the right filter for a scenario and place devices in the correct zone.
How it works
Access control lists
An ACL is a list of rules that a router, switch or firewall checks in order. Each rule matches fields such as source address, destination address, protocol (for example Transmission Control Protocol, TCP) and port, and then permits or denies the traffic.
The first matching rule is applied, and later rules are ignored. Most ACLs end with an implicit deny, so traffic that matches no rule is dropped.
1. permit TCP from any to web server port 443
2. permit TCP from admin subnet to any port 22
3. deny any from any to anyOrder matters. A broad deny placed above a specific permit blocks the traffic that the permit was meant to allow. Place specific rules first and general rules last.
An ACL is applied in a direction, either inbound or outbound on an interface. The same list behaves differently depending on where and how it is applied.
Firewall types
| Type | How it decides |
|---|---|
| Stateless packet filter | Checks each packet alone against the rules |
| Stateful firewall | Tracks connections, so replies to allowed traffic are allowed automatically |
| Next generation firewall (NGFW) | Stateful plus application awareness, user identity, intrusion prevention and content inspection |
| Web application firewall (WAF) | Protects web applications from attacks such as injection |
A stateful firewall needs a rule only for the direction that starts the connection. A stateless filter needs rules for both directions.
Web and content filtering
Uniform Resource Locator (URL) filtering blocks or allows access to web addresses or categories, such as gambling or known malware sites. Content filtering inspects the content of traffic or pages for banned material, malware or sensitive data.
Both can be done by a firewall, a proxy or a cloud security service. They support acceptable use policies and reduce the risk of malicious downloads.
Intrusion detection and prevention
An intrusion detection system (IDS) watches traffic and alerts. An intrusion prevention system (IPS) sits in the path and blocks malicious traffic. They detect attacks by signatures of known threats and by unusual behavior.
Security zones
A zone groups networks with the same trust level, and a firewall controls what flows between zones.
| Zone | Trust level | Typical contents |
|---|---|---|
| Untrusted | Low | The internet |
| Trusted | High | Internal user and server networks |
| Screened subnet | Middle | Public servers such as web or mail servers, in a buffer between the other two |
A screened subnet (formerly called a demilitarized zone, DMZ) keeps public facing servers away from the internal network. If a public server is compromised, the attacker still faces the firewall before reaching internal systems.
Traffic rules are usually strict: the internet may reach the screened subnet on specific ports, the screened subnet may not start connections into the internal network, and the internal network may reach out.
Allow list and deny list
An allow list permits only what is named, and everything else is denied. A deny list blocks what is named and permits the rest. Allow lists are stricter and preferred for sensitive boundaries.
What to remember for the exam
- ACL rules are checked in order, the first match wins, and an implicit deny ends the list.
- Put specific rules before general rules.
- A stateful firewall tracks connections and allows return traffic. A stateless filter does not.
- An NGFW adds application awareness, intrusion prevention and content inspection.
- URL filtering blocks by address or category. Content filtering inspects what is inside.
- An IDS alerts, and an IPS blocks inline.
- A screened subnet holds public servers between the untrusted and trusted zones.
- Allow lists are stricter than deny lists.
If a rule seems correct but traffic still fails, check the rule order and the direction it is applied. A deny above a permit is a classic cause.
Common mistakes
Placing a general deny above a specific permit. The permit is never reached.
Forgetting the implicit deny. Traffic that no rule allows is dropped, even without a deny rule.
Putting public servers in the internal network. A compromise of one gives direct access to everything.
Expecting a stateless filter to handle replies. It needs explicit rules for the return direction.
Treating URL filtering as full protection. Attackers can host malware on legitimate sites, so use layered controls.
Editing a firewall or ACL on a remote device without a rollback plan can lock you out. Test the change, keep a backup of the configuration and use a timed revert where available.
Check yourself
Work through these three.
What happens to traffic that matches no ACL rule?
It is dropped by the implicit deny at the end of the list.
What is the main advantage of a stateful firewall?
It tracks connections, so replies to allowed traffic are accepted without separate rules.
Where should a public web server be placed?
In a screened subnet, separated from both the internet and the internal network by the firewall.
Topic 7 of 7 in Network Security
Test yourself on Network Security
The full CompTIA Network+ N10-009 question bank has 910 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.