We will start with a fictional organization's security policy. Based on that policy, we will then develop a firewall rulebase. Along the way, I will cover some of the Do's and Don'ts of rulebase configuration. Also, we will cover rules that every firewall should have. Hopefully by the end of the paper you will have a better understanding of how to build a secure rulebase for your organization.
Management builds the security policy, which defines what is to be enforced.
The firewall is a technical tool, which is how the policy gets enforced. So, before we start building our rulebase, we have to understand our security policy. Since this paper focuses on rulebase design, we will keep our security policy relatively simple. Fortunately for us, our organization has a simple security policy, which management has outlined as follows. Internal employees are allowed unrestricted access to the Internet.