1. The Story
Press "Next" to go through it step by step. At each step, a character appears and explains what they are doing.
Prologue: a quick review
Step 1 of 11
More and more doors at home
My job is finding the way: if I know how to get there, I send Pip along. But now the home has a family zone, a guest zone and a VPN side door, and out on the Internet someone keeps knocking. Just finding the way is no longer safe enough.
Animation text version (all steps)
- Prologue: a quick review
- More and more doors at home · Rue: My job is finding the way: if I know how to get there, I send Pip along. But now the home has a family zone, a guest zone and a VPN side door, and out on the Internet someone keeps knocking. Just finding the way is no longer safe enough.
- Act 1: Pango starts work
- Pango and his list · Pango: I'm a Firewall! The list in my hands is called an ACL (Access Control List). Whenever a Pip passes by, I start at the first line and check each one in turn, and I do whatever the first match says. You're not on the list. No entry!
- ① Allow: replies to established connections
- ② Allow: Internet →
203.0.113.1UDP51820(VPN) - ③ Deny: Guest zone
192.168.20.0/24→ Family zone192.168.1.0/24 - ④ Allow: Guest zone → anywhere
- ⑤ Allow: Family zone → anywhere
- (Last) Deny: everything else
- Mac goes online · Pip: I set off from Mac, heading for
192.0.2.80:443. Pango checks line by line: not line 1, not line 2... line 5, "Family zone → anywhere: Allow". A match! Pango also writes this connection down in his State Table. - Replies get in automatically · Pango: Here comes the reply from
example.com. I check the State Table: this is the connection Mac just started! Line 1, "Replies to established connections: Allow". A Firewall that remembers connections is called a Stateful Firewall. - An uninvited stranger · Pango: The stranger
192.0.2.66wants to connect to Port 23 on203.0.113.1. I check from line 1 to line 5, and not a single one matches. At the end of the list there is an invisible rule: deny everything. You're not on the list. No entry!- Implicit Deny: every ACL ends with an invisible "deny everything"
- The VPN side door · Pip: Mac is at a coffee shop and connects back home through the VPN. The outer packet is addressed to
203.0.113.1UDP51820. Pango checks: line 2, allow! - Act 2: Rules for the guest zone
- A guest wants to reach Mac · Pango: The guest laptop
192.168.20.10wants to connect to Mac192.168.1.10. Not line 1 or 2; line 3, "Guest zone → Family zone: Deny". A match! Denied! - Guests can surf just fine · Pango: Now the guest laptop connects to
example.cominstead. Line 3's destination is the family zone, so it does not match; line 4, "Guest zone → anywhere: Allow". A match! - If the order is wrong... · Rue: Suppose someone swapped lines 3 and 4. A guest looking for Mac would match "Guest zone → anywhere: Allow" first, and once Pango follows it, he stops reading. The deny rule would never be used, and the guest would reach Mac directly!
- Put narrower, stricter rules first
- Put broader rules later
- Act 3: Layers of protection
- Open only the doors you need · Pango: My principle is Least Privilege: allow only what is truly needed and deny everything else. Also, I only guard the front door. Every computer should switch on its own Firewall too, so if a bad guy has already got inside the house, there is one more layer of protection.
- Stateless Firewall: checks every Packet on its own
- Stateful Firewall: remembers connections and lets replies through automatically
- Next-Generation Firewall: also recognises applications
- Summary: the guard at the door · Pango: An ACL is checked from top to bottom and stops at the first match; if nothing matches, the packet is denied. Narrow rules go first, broad rules go later. You're not on the list. No entry!
2. Where Is the Problem
Rue is a Router. His job is to find the way: if he knows how to get somewhere, he sends the packet there. He never asks, "Should this packet be going there at all?"
But Mac's home is getting busier and busier:
- Family zone
192.168.1.0/24: Mac192.168.1.10and the other family devices. - Guest zone
192.168.20.0/24: the Wi-Fi (wireless network) that friends use when they visit, for example the guest laptop192.168.20.10. - A small VPN (Virtual Private Network) side door: it lets Mac connect back home when he is out.
- And out on the Internet, a stranger
192.0.2.66keeps knocking on the door. (Note: an address starting with 192 is not necessarily Private. Only addresses starting with 192.168 are.)
Guests may surf the Internet, but they should not see Mac's files. Strangers should certainly not get in. Just finding the way is no longer safe enough.
3. How the Network Solves It
Hire a guard for the front door: Pango.
A Firewall is a device or piece of software that decides, according to rules, whether a packet may pass. The list of rules in its hands is called an ACL (Access Control List). Each line says "this kind of packet → allow or deny".
Whenever a packet comes along, Pango starts at the first line of the list and checks each line in turn. As soon as one line matches, he does what it says and stops reading. And if nothing on the whole list matches? You're not on the list. No entry!
4. A Closer Look
Pango's list
| Order | Condition | Action |
|---|---|---|
| 1 | Replies to established connections | Allow |
| 2 | Internet → 203.0.113.1 UDP 51820 (VPN) |
Allow |
| 3 | Guest zone 192.168.20.0/24 → Family zone 192.168.1.0/24 |
Deny |
| 4 | Guest zone → anywhere | Allow |
| 5 | Family zone → anywhere | Allow |
| (Last) | Everything else | Deny |
Each rule can look at the packet's sender and receiver IP Address, the protocol used, that is TCP (Transmission Control Protocol) or UDP (User Datagram Protocol), and the Port number.
Three iron rules
- Check from top to bottom, one line at a time.
- Stop at the First Match. As soon as a line matches, do what it says and ignore the rules below it.
- There is an Implicit Deny at the end. At the bottom of the list sits an invisible "deny everything" line. Any packet that matches nothing gets stopped.
The six packets in the story
| Packet | Which line matches | Result |
|---|---|---|
Mac 192.168.1.10 → 192.0.2.80:443 |
Line 5 | Allow |
192.0.2.80:443 replies to Mac |
Line 1 | Allow |
Stranger 192.0.2.66 → 203.0.113.1 Port 23 |
None | Implicit Deny, denied |
Coffee shop via VPN → 203.0.113.1 UDP 51820 |
Line 2 | Allow |
Guest 192.168.20.10 → Mac 192.168.1.10 |
Line 3 | Deny |
Guest 192.168.20.10 → 192.0.2.80:443 |
Line 4 | Allow |
Port 23 is an old remote login service called Telnet. It is unencrypted and often broken into, so strangers love to try it.
Why does the order matter so much?
Suppose someone swapped lines 3 and 4:
3. Guest zone → anywhere: Allow ← a guest looking for Mac matches this line first!
4. Guest zone → Family zone: Deny ← never gets used
Because checking stops at the First Match, the broad "anywhere" rule lets every guest packet through before the deny rule gets a chance. So remember: put narrower, stricter rules first and broader rules later.
How do replies get in? The State Table
Mac visits example.com, and the reply comes in from the Internet. There is no "Internet → Family zone: Allow" line on the list, so how does the reply get through?
Because Pango is a Stateful Firewall: a firewall that remembers connections. When Mac's packet goes out, Pango writes the connection down in his State Table:
192.168.1.10:50000 ↔ 192.0.2.80:443 TCP Established
When the reply comes in, Pango checks the table, sees that Mac started this connection himself, and lets it through under line 1. When a stranger comes knocking uninvited, there is no record in the table, so he cannot get in. This is very similar to the NAT Table used by NAT (Network Address Translation), and home Routers usually do both jobs together.
Three kinds of Firewall
| Kind | How it works |
|---|---|
| Stateless Firewall | Checks every packet on its own and does not remember earlier connections; replies need separate rules |
| Stateful Firewall | Remembers connections and lets replies through automatically |
| Next-Generation Firewall | Besides addresses and Ports, it also recognises which application is being used |
Open only the doors you really need
Pango's principle is Least Privilege: allow only what is truly needed and deny everything else. Also, he only guards the front door, so it is best for every computer to switch on its own Firewall as well. If a bad guy has already got inside the house, that gives one more layer of protection.
5. Try It Yourself
Task: find the Firewalls around you
- Windows: open "Settings", search for "firewall", and check whether the firewall in "Windows Security" is turned on. Mac: open "System Settings" → "Network" → "Firewall".
- Log in to your home Router's settings page (you will usually need to ask a parent), and look for the "Firewall" or "Guest network" settings.
- Think about it: is the guest Wi-Fi at home just like the guest zone in the story?
Mini game
What would Pango do?
Pango's list is the one above. For each packet below, would Pango allow it or deny it?
-
1Mac 192.168.1.10 connects to 192.0.2.80:443
-
2Stranger 192.0.2.66 connects to 203.0.113.1:23
-
3Guest laptop 192.168.20.10 connects to Mac 192.168.1.10
-
4Guest laptop 192.168.20.10 connects to 192.0.2.80:443
-
5192.0.2.80:443 replies to Mac's earlier request
-
6Mac, at a coffee shop, connects through the VPN to 203.0.113.1:51820
All sorted correctly! Check line by line from top to bottom and follow the first match; if nothing matches, the final Implicit Deny stops the packet.
6. Where the Analogy Breaks
- Pango does not read the letter inside. An ordinary Firewall only looks at the addresses, protocol and Port in the header. It cannot tell whether a packet is a scam email.
- Pango is not necessarily a separate machine. Home Routers usually have a Firewall built in. The animation draws Pango behind Rue only to make things easy to see, which is why packets addressed to
203.0.113.1also pass Pango's check in the animation. - Pango does not invent the list himself, and this one is simplified. An ACL must be set up by people. If a rule is written wrongly or put in the wrong order, Pango will still just follow it. A real setup would also need a line saying "VPN network
192.168.50.0/24→ Family zone: Allow"; otherwise, Pip would be stopped by the Implicit Deny after being decrypted. - Pango cannot do everything. If you click a bad link yourself, the connection goes out from inside the house, and line 5 will allow it. So you still need to be careful and keep your software up to date.
- Being denied does not always get a reply. Many Firewalls simply drop the packets they stop. The sender may not even know it was blocked; it just waits until it times out.
7. Quiz
8. Key Notes
- A Firewall uses an ACL (Access Control List) to decide whether a packet is allowed or denied.
- An ACL is checked from top to bottom; the first matching line is applied and checking stops. If nothing matches, the final Implicit Deny stops the packet.
- Put narrower rules first and broader rules later; otherwise the narrow rules will never be used.
- A Stateful Firewall uses a State Table to remember connections from inside to outside, letting replies through automatically while keeping out uninvited strangers.
- The principle is Least Privilege: open only the doors you really need.
Further reading
Pango is guarding the front door well, so the bad guys cannot get in. But what if too many good guys rush in at once, say during a big sale at example.com, and one server cannot cope? In the final story, Rue introduces his distant relative: the Load Balancer, and shows how to achieve High Availability.