50 firewall best practices

Rule design and least privilege

1. Default-deny: block everything, then explicitly permit only what is required
2. Scope every rule to specific sources, destinations and services — avoid any/any
3. Avoid 'any' in the service field; specify exact ports and protocols
4. Avoid 'any' in source and destination; use precise address objects
5. Document the business justification and owner for every rule
6. Use descriptive, consistent naming for rules and objects
7. Group related objects logically instead of duplicating them
8. Order rules so specific rules precede broad ones; avoid shadowing
9. Remove temporary rules on a defined expiry, not 'eventually'
10. Re-validate that each rule still reflects a current business need

Segmentation and architecture

1. Segment the network into zones based on trust and function
2. Isolate sensitive environments (cardholder data, OT, ePHI) into dedicated zones
3. Enforce least privilege between zones, not just at the perimeter
4. Place public-facing services in a DMZ, never directly on internal networks
5. Restrict lateral movement by limiting east-west traffic
6. Separate management traffic onto a dedicated network where possible
7. Use explicit deny rules with logging at zone boundaries
8. Avoid trust relationships that bypass the firewall between zones

Management and administrative security

1. Never expose management interfaces to the internet
2. Restrict administrative access to specific trusted source addresses
3. Use strong, unique admin credentials and enforce MFA
4. Disable unused administrative protocols and services
5. Use HTTPS/SSH only for management; disable insecure protocols
6. Apply role-based access so admins have only the rights they need
7. Keep firmware and security signatures patched and current
8. Change all default accounts and credentials before deployment

Logging and monitoring

1. Enable logging on security-relevant rules, including denies
2. Forward logs to a central SIEM or log server for retention
3. Ensure logs are time-synchronized via NTP
4. Alert on suspicious patterns and policy violations
5. Retain logs long enough to meet compliance and investigation needs
6. Review logs to confirm rules behave as intended

VPN and remote access

1. Use strong, modern encryption and key-exchange parameters
2. Disable weak or deprecated ciphers and DH groups
3. Scope VPN access to only the resources each user or site needs
4. Require MFA for remote access wherever possible
5. Terminate VPNs into a controlled zone, not directly onto internal LAN
6. Review remote-access rules as carefully as internet-facing ones

Maintenance and review

1. Review the full rule base at least quarterly, and after major changes
2. Identify and remove unused, shadowed and redundant rules
3. Track configuration changes with an audit trail and approvals
4. Maintain configuration backups and test restoration
5. Measure posture over time with a consistent baseline or score
6. Re-scan after every change to catch newly introduced risk
7. Document each review to satisfy compliance evidence requirements
8. Automate review so it actually happens at the needed frequency
9. Validate segmentation periodically rather than assuming it holds
10. Decommission rules tied to retired systems immediately
11. Keep an inventory of internet-facing exposure and minimize it
12. Treat the firewall as code: review changes before they ship

Putting it into practice