Module 2 · Defending a small network Lesson 4 of 15
Networks, ports and what a firewall rule means
An IP address identifies a machine and a port identifies a service on it. A firewall rule allows or denies traffic between addresses and ports, and reading one is a core skill.
The concept
A network moves packets between addresses. An address identifies a machine; a port identifies a service on it — 22 for SSH, 80 and 443 for the web, 3306 and 5432 for databases. A service listening on a port is a door, and whether the door is reachable from the internet is the whole question.
A firewall rule is one line of permission: allow, from an address range, to a port. Read them as sentences and they stop being scary. The rule you want is almost always "allow 443 from anywhere; allow 22 only from the office", and the one you do not want is "allow all to all", which is what a default cloud security group often gives you.
# Allow SSH, HTTP, HTTPS - drop everything else.
sudo ufw default deny incoming
sudo ufw allow 22/tcp
sudo ufw allow 80,443/tcp
sudo ufw enable
sudo ufw status verbose
# 22 SSH . 80 HTTP . 443 HTTPS . 3306 MySQL (NEVER expose to the internet)Common mistakes
The mistake is opening a database port "temporarily" to test locally and forgetting it. Databases belong behind the application server, never exposed; that single rule is behind a large share of breached small systems.
Worked example
"Allow 443 from anywhere, deny everything else" is a rule you can explain. "Allow all" with a note saying review later is how test environments become production incidents.
Your practice task
Write the allow-and-deny list for a small office that needs web, mail and remote access — and nothing else.
Do this before moving on. Reading a solution teaches the shape of it; typing it teaches you.
Key takeaway
A network moves packets between addresses.
Keep your place in this course
A free account saves which lessons you have finished and unlocks the certificate. The lesson itself stays free to read.
Create free account or sign inCourse complete
You finished every lesson.
Your certificate is ready, and the projects you built are the proof to attach to an application.
Almost there
15 lessons left of 15
Finish every lesson to unlock the certificate. Each one ends in a practice task — do them and the final project brief writes itself.