Firewalls

First principles

A firewall is a policy on packets. Default deny means the policy is empty until you write an allow. A packet that does not match an allow does not enter. Default allow with a list of blocks is the opposite idea wearing the same name: you are forever chasing what you forgot.

A host firewall enforces that policy on one machine. A network firewall enforces it on a path — a segment, a VPC, an office edge. You want both. The network device cannot see a process binding to a port on the host. The host cannot see a neighbour you never meant to be on the same VLAN. They fail differently. That is useful.

Allow-lists are specific

22, 80, and 443 are a common example of an allow-list for a public Linux host that speaks SSH and HTTP(S). They are not a universal rule. A mail exchanger needs 25. A closed management network may allow 22 from a jump host only, and nothing from the internet. A workstation may allow nothing inbound. Copying someone else's ports is how you open 22 to the world by accident.

What an admin actually does

• Default deny inbound on hosts and on the edge. Open a port because a named service on a named interface requires it.
• SSH from the internet is a choice. If you do not need it, do not allow 22. Use a VPN or a cloud serial / console for the box.
• Egress matters too. Workloads that never need to call the internet should not be able to. That is still default deny, facing out.
• Document the allows with an owner and a reason. An allow without an owner is how ports live forever.