Firewall ACL — FW-EDGE-01

Stateful firewall, conntrack enabled, first-match-wins, implicit deny at the bottom.

Active policy

# rule  action     src              dst              proto  dport     comment
1      permit  any              any              any    any       state ESTABLISHED,RELATED
10     permit  any              10.0.5.40        tcp    443       webserver HTTPS
11     permit  any              10.0.5.40        tcp    80        webserver HTTP
20     permit  10.0.0.0/8       any              tcp    443       outbound HTTPS from LAN
21     permit  10.0.0.0/8       any              udp    53        outbound DNS from LAN
22     permit  10.0.0.0/8       any              tcp    80        outbound HTTP from LAN
50     deny    any              10.0.5.40        tcp    22        no SSH on webserver
100    permit  10.0.0.0/8       any              any    any       LAN any outbound
# implicit deny all

Packets to trace

#DirectionProtoSrcDst
1WAN→LANtcp203.0.113.55:5412310.0.5.40:443
2WAN→LANtcp198.51.100.7:5120010.0.5.40:22
3WAN→LANudp8.8.8.8:5310.0.10.20:54123 (reply to existing query)
4LAN→WANtcp10.0.5.40:443203.0.113.55:54123 (reply on existing session)