Network Segmentation Approaches

Scott Weeks surfer at
Wed May 6 22:30:01 UTC 2015

--- rsk at wrote:
From: Rich Kulawiec <rsk at>

The first rule in every firewall is of course 
"deny all" and subsequent rulesets permit only 
the traffic that is necessary.  

I think you got this backward?  That way all 
traffic is blocked, so none is allowed through.  
Also, deny by default at the end of the rule 
set is not the best thing for every network 
that needs a firewall.  Some just want to block 
bad stuff they see and allow everything else. 
(And some have stated here that they will block 
entire countries until their culture changes!)


More information about the NANOG mailing list