Firewalls and packet filtering in Computer Networks - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

How does a stateful firewall differ from a stateless firewall?

Which of the following best describes the main difference between a stateful firewall and a stateless firewall?

A A stateless firewall encrypts data packets, while a stateful firewall does not.

B A stateless firewall uses machine learning to detect threats, while a stateful firewall uses fixed rules.

C A stateful firewall only filters incoming packets, while a stateless firewall filters both incoming and outgoing packets.

D A stateful firewall tracks the state of active connections, while a stateless firewall filters packets individually without context.

💡 Hint

Think about whether the firewall remembers previous packets or treats each packet on its own.

Stateful firewalls keep track of the connection state and context, allowing them to make more informed decisions. Stateless firewalls treat each packet independently without memory of past packets.

📋 Factual

intermediate

What is the primary function of a packet filter firewall?

What is the main role of a packet filter firewall in network security?

A To filter packets based on source and destination IP addresses and ports.

B To inspect the content of data packets and block viruses.

C To encrypt all network traffic between two points.

D To monitor user behavior and block suspicious activities.

💡 Hint

Consider what basic information is available in packet headers.

Packet filter firewalls examine packet headers such as IP addresses and port numbers to decide whether to allow or block packets.

🔍 Analysis

advanced

Analyzing firewall rule order impact

Given these firewall rules applied in order, what will happen to a packet from IP 192.168.1.10 to port 80?

1. Deny all traffic from 192.168.1.0/24
2. Allow traffic to port 80

A The packet will be allowed because the allow rule matches port 80.

B The packet will be denied because the deny rule matches the source IP first.

C The packet will be allowed because rules are applied simultaneously.

D The packet will be denied because port 80 is blocked by default.

💡 Hint

Remember that firewall rules are processed in order, and the first matching rule applies.

The first rule denies all traffic from the 192.168.1.0/24 subnet, so the packet is blocked before reaching the allow rule.

❓ Comparison

advanced

Comparing firewall types for application layer filtering

Which firewall type is best suited for filtering traffic based on application data, such as HTTP requests?

A Proxy firewall

B Stateful firewall

C Packet filter firewall

D Circuit-level gateway

💡 Hint

Think about which firewall can inspect the actual content of the communication.

Proxy firewalls act as intermediaries and can inspect application layer data, allowing them to filter based on content like HTTP requests.

❓ Reasoning

expert

Identifying the cause of a firewall bypass

A network administrator notices that unauthorized traffic is passing through the firewall despite rules blocking it. Which of the following is the most likely cause?

A The unauthorized traffic uses a protocol that firewalls cannot inspect.

B The firewall hardware is physically damaged and cannot filter packets.

C The firewall is configured with overlapping rules that allow the traffic before the block rule.

D The firewall is set to block all traffic by default.

💡 Hint

Consider how rule order and overlaps affect firewall behavior.

Overlapping rules where an allow rule appears before a block rule can cause unauthorized traffic to pass through because the first matching rule is applied.

Practice

1. What is the primary function of a firewall in a computer network?

easy

A. To allow or block data packets based on security rules

B. To increase the speed of data transmission

C. To store data packets temporarily

D. To convert data packets into different formats

Solution

1. Step 1: Understand the role of a firewall

   A firewall controls network access by filtering data packets according to security rules.

2. Step 2: Identify the correct function

   It does not speed up transmission, store packets, or convert formats; it only allows or blocks packets.

3. Final Answer:

   To allow or block data packets based on security rules -> Option A

4. Quick Check:

   Firewall function = Allow/block packets [OK]

Hint: Firewalls control access by blocking or allowing packets [OK]

Common Mistakes:

• Thinking firewalls speed up network traffic
• Confusing firewalls with data storage devices
• Believing firewalls change packet formats

2. Which of the following is a correct example of a packet filtering rule?

easy

A. Store packets for later analysis

B. Block packets based on their payload content

C. Convert packets from TCP to UDP

D. Allow packets from IP 192.168.1.10 to port 80

Solution

1. Step 1: Understand packet filtering rules

   Packet filtering rules specify conditions like source IP and destination port to allow or block packets.

2. Step 2: Identify the valid rule

   Allowing packets from a specific IP to a specific port is a valid rule; converting or storing packets is not filtering.

3. Final Answer:

   Allow packets from IP 192.168.1.10 to port 80 -> Option D

4. Quick Check:

   Packet filtering = Allow/block by IP and port [OK]

Hint: Packet filtering rules specify IP and port conditions [OK]

Common Mistakes:

• Confusing filtering with packet conversion
• Thinking filtering stores packets
• Believing all packets are always blocked

3. Consider a firewall rule: Block packets from IP 10.0.0.5 to port 22. What will happen if a packet from IP 10.0.0.5 tries to connect to port 22?

medium

A. The packet will be redirected to another port

B. The packet will be allowed through the firewall

C. The packet will be blocked by the firewall

D. The packet will be logged but allowed

Solution

1. Step 1: Analyze the firewall rule

   The rule explicitly blocks packets from IP 10.0.0.5 to port 22.

2. Step 2: Determine the packet's fate

   Since the packet matches the block rule, it will be stopped and not allowed through.

3. Final Answer:

   The packet will be blocked by the firewall -> Option C

4. Quick Check:

   Block rule matched = Packet blocked [OK]

Hint: Block rules stop matching packets from passing [OK]

Common Mistakes:

• Assuming packets are redirected instead of blocked
• Thinking packets are logged but allowed by default
• Confusing allow and block rules

4. A firewall rule is written as: Allow packets to port 443 from any IP. However, packets from IP 192.168.1.20 to port 443 are still blocked. What is the most likely error?

medium

A. There is a conflicting block rule with higher priority

B. The firewall does not filter packets by port

C. Port 443 is not used for secure connections

D. The rule is missing a source IP specification

Solution

1. Step 1: Review the allow rule

   The rule allows packets to port 443 from any IP, so it should permit packets from 192.168.1.20.

2. Step 2: Identify possible conflicts

   If packets are blocked despite the allow rule, a block rule with higher priority likely overrides it.

3. Final Answer:

   There is a conflicting block rule with higher priority -> Option A

4. Quick Check:

   Conflicting rules = Block overrides allow [OK]

Hint: Check for higher priority block rules when allow fails [OK]

Common Mistakes:

• Believing port 443 is not for secure connections
• Ignoring rule priority order
• Assuming firewall ignores ports

5. You want to create a firewall rule that allows HTTP traffic (port 80) only from the IP range 192.168.1.0 to 192.168.1.255 and blocks all other HTTP traffic. Which approach correctly applies packet filtering to achieve this?

hard

A. Block packets from 192.168.1.0/24 to port 80; then allow all packets to port 80

B. Allow packets from 192.168.1.0/24 to port 80; then block all packets to port 80

C. Allow all packets to port 80 without IP restrictions

D. Block all packets to port 80 without exceptions

Solution

1. Step 1: Define the allow rule for the IP range

   Allow packets from IP range 192.168.1.0/24 (which covers 192.168.1.0 to 192.168.1.255) to port 80.

2. Step 2: Define the block rule for all other HTTP traffic

   Block all other packets to port 80 that do not match the allow rule.

3. Final Answer:

   Allow packets from 192.168.1.0/24 to port 80; then block all packets to port 80 -> Option B

4. Quick Check:

   Allow specific IP range, then block others = Correct filtering [OK]

Hint: Allow specific IP range first, then block others [OK]

Common Mistakes:

• Blocking allowed IP range by mistake
• Allowing all traffic without restrictions
• Reversing allow and block order