Destination Rules

A destination firewall decides which incoming connections a computer accepts. Use it to block access that the source does not need.

In this example, office computers should not reach demo-shop’s administration port. Add a deny rule at the beginning:

seclab firewall demo-shop deny 22 office at 1

You should see:

Added rule 1 on demo-shop: deny 22 from office. Rules are checked top down.

Inspect the rules:

seclab machine demo-shop

Look for these lines:

firewall (first match wins, anything unmatched is blocked):
rule  action  port  from    note
1     deny    22    office

The rule applies to port 22 from office. It leaves retail traffic to port 443 alone. The position matters because this firewall uses the first matching rule.

Choose the source and service supported by the incident evidence. Blocking every port from every zone would also block customers and payments.