Firewall Practice Lab

Linux Exercises (iptables)

1️⃣ Block PING to a host

Test connectivity before blocking:

ping 193.226.19.42

Add the rule to block ICMP:

sudo iptables -A OUTPUT -d 193.226.19.42 -p icmp -j DROP

Verify the rule:

sudo iptables -L -n -v
sudo iptables -S

Test again (ping should fail).

Remove the rule after testing:

sudo iptables -D OUTPUT -d 193.226.19.42 -p icmp -j DROP

Note: Students can observe that ICMP (ping) is blocked only for the specified host.

2️⃣ Block HTTP but allow HTTPS

Test before blocking:

curl http://davos.umfst.ro
curl https://davos.umfst.ro

Add the rule to block HTTP:

sudo iptables -A OUTPUT -d 193.226.19.42 -p tcp --dport 80 -j DROP

Test again:

curl http://davos.umfst.ro   # ❌ should fail
curl https://davos.umfst.ro  # ✅ should succeed

Remove the rule after testing:

sudo iptables -D OUTPUT -d 193.226.19.42 -p tcp --dport 80 -j DROP

3️⃣ Optional Cleanup

sudo iptables -F        # flush all rules
sudo iptables -P OUTPUT ACCEPT  # reset default policy

✅ Students should understand the effect of each rule, the order of rules, and default policy.

Windows Exercises (Windows Defender Firewall)

1️⃣ Block PING to a host

Steps:

1. Open "Windows Defender Firewall with Advanced Security"
2. Go to Outbound Rules → New Rule
3. Rule Type: Custom
4. Protocol: ICMPv4
5. Remote IP: 193.226.19.42
6. Action: Block
7. Apply the rule

Test:

ping 193.226.19.42

2️⃣ Block HTTP but allow HTTPS

1. Open Outbound Rules → New Rule
2. Rule Type: Port
3. Protocol: TCP
4. Remote port: 80
5. Remote IP: 193.226.19.42
6. Action: Block
7. Apply the rule

Test in browser:

http://davos.umfst.ro   # ❌ blocked
https://davos.umfst.ro  # ✅ allowed

Optional CLI version:

netsh advfirewall firewall add rule name="Block HTTP" dir=out action=block protocol=TCP remoteport=80 remoteip=193.226.19.42
netsh advfirewall firewall delete rule name="Block HTTP"
netsh advfirewall firewall show rule name="Block HTTP"

✅ Students learn host-based firewall rules and protocol/port blocking on Windows.

Teaching Tips

Always test connectivity before adding a rule.
Observe the effect of specific rules on traffic.
Use iptables -L -n --line-numbers to show rule order.
Discuss default policy: ACCEPT vs DROP.
Encourage experimentation (e.g., allow only HTTPS, block all others).