Rule Order

A correct rule can have no effect if an earlier rule already decides the connection. Lumen’s firewall stops at the first match.

Inspect this practice policy:

seclab machine demo-shop

Look for these lines:

firewall (first match wins, anything unmatched is blocked):
rule  action  port  from    note
1     allow   any   any
2     deny    22    office  never used: rule 1 decides first

The allow-any rule is first. The office administration deny below it is never reached. Move the existing deny ahead of it:

seclab firewall demo-shop move 2 1

You should see:

Moved rule 2 on demo-shop to position 1. Rules are checked top down.

Read the order again:

seclab machine demo-shop

Look for these lines:

firewall (first match wins, anything unmatched is blocked):
rule  action  port  from    note
1     deny    22    office
2     allow   any   any

The deny now decides office traffic to port 22. Other traffic can continue to the next rule. Changing order fixes this policy without adding another copy of the same deny.