COMMON MISCONFIGURATIONS
Overly permissive source — using "any" as source for sensitive destinations (databases, admin interfaces) instead of specific trusted subnets.
Insecure protocols — permitting Telnet (23), FTP (21), or unencrypted HTTP (80) where encrypted alternatives exist.
Shadowed rules — a rule that can never be reached because a more general rule above it matches the same traffic first.
Catch-all allows — a broad ALLOW ANY ANY rule before the implicit deny, negating all deny rules below it.
Missing egress filtering — no rules controlling what internal hosts can connect to externally. Critical for C2 detection.
SHADOWED RULES
Rules are evaluated top-down. If Rule 5 allows TCP any:any -> 10.10.17.0/24:3306, then Rule 7 denying TCP 0.0.0.0/0 -> 10.10.17.0/24:3306 is shadowed — the deny never fires because the allow above already matches.
LEAST PRIVILEGE PRINCIPLE
Every rule should grant the minimum access needed. Source should be specific IPs or subnets, not "any". Destination port should be exact, not port ranges where possible.
EGRESS FILTERING
Outbound rules are just as important as inbound. Without egress filtering: malware can establish C2 on any port, data exfiltration goes unblocked, DNS tunneling and beacon traffic is unrestricted.
RULE ORDER BEST PRACTICE
1. Deny known bad (threat intel blocks)
2. Allow specific required traffic
3. Deny everything else (explicit deny)
# Never: broad ALLOW before specific DENY