Checklist · Servers

Firewall rule review

A periodic review that removes forgotten rules and checks the ones that remain still match a real need.

Owner: Network engineerTime: 2 hours, each quarter

0 of 18

Before you start

It has an owner, a purpose and a change reference; rules with none are flagged.
It has no "any" in source, destination or service unless there is a written reason.
Temporary rules carry an expiry date, and expired ones are removed.
Rules with zero hits in 90 days are disabled first and deleted after a further 30 days of no complaints.
Source and destination are specific networks or groups, not whole data-centre ranges.
Shadowed rules (never reached because an earlier rule matches) and duplicates are removed.

The last rule in each direction is an explicit deny with logging.
Outbound traffic is restricted for servers; they cannot reach the whole internet by default.
Management ports (SSH, RDP, database ports) are not open to the internet.
Inbound rules to the DMZ match the list of published services exactly.
Administration of the firewall itself needs MFA and is reachable only from the admin network.

Changes go through the change process, in batches small enough to roll back.
An external scan confirms the open ports match the rules intended to allow them.
Firewall firmware is current, and logs reach the SIEM.
The review result and the next review date are recorded.

Adjust it to your environment before relying on it. A finished list shows a routine was followed; it does not guarantee nothing was missed.

14-day free trial. No credit card. Cloud or on-premises.