6 Firewall Access Control Rules

I. What is Access Control and Why is it Needed?

In industrial internet and IT networks, a firewall is the first line of defense for network security. The core capability of a firewall is its access control rules, which determine "who, at what time, by what method, can access what resources."

In simple terms, access control is like a factory gatekeeper—checking each visitor's identity, arrival time, and items, and deciding whether to grant entry based on established rules. A firewall's access control rules are the "gatekeeper system" for the network world.

II. Six Common Types of Access Control Rules

Based on granularity, firewall access control rules can be categorized into the following six types:

1. Port-Based Control

Principle: Network communication uses specific port numbers to distinguish different services. For example, web services typically use port 80 (HTTP) and port 443 (HTTPS), while SSH remote management uses port 22.

Control Method: The firewall decides whether to allow a data packet through by checking its port number. For example, a rule can be configured as "Block TCP port 8080" to restrict traffic on that specific port.

Application Scenario: Blocking service ports known to have vulnerabilities to reduce the attack surface. In industrial networks, this could mean restricting access to device management ports (e.g., 23/Telnet) and enforcing the use of more secure ports (e.g., 22/SSH).

2. IP-Based Control

Principle: Every networked device has a unique IP address. IP-based access control decides whether to permit traffic by checking the source or destination IP address in the data packet.

Control Method: Administrators can configure rules like "Allow: 192.168.1.10 (specific IP)" or "Block: 192.168.2.20 (specific IP)."

Application Scenario: Allowing only specific IP addresses (such as a management terminal) to access core control systems, while denying all others. In industrial settings, this typically means only allowing engineering workstations or specific network segments to access critical PLCs.

3. Time-Based Control

Principle: Some network access needs are time-sensitive. Time-based access control allows administrators to set policies based on time periods.

Control Method: Configuring rules like "Allow: 9:00–17:00 (working hours)" and "Block: 17:00–24:00 (after hours)."

Application Scenario: Restricting network access outside of working hours to reduce the risk of unauthorized access. For example, in unattended remote sites, remote management ports can be configured to open only during scheduled maintenance windows.

4. Protocol-Based Control

Principle: Different network protocols carry different security risks. For example, HTTPS and SSH are encrypted secure protocols, while HTTP and Telnet transmit data in plaintext and are vulnerable to eavesdropping.

Control Method: Configuring rules like "Allow: HTTPS, SSH" and "Block: HTTP, Telnet."

Application Scenario: Enforcing the use of secure protocols and blocking plaintext protocols to protect data confidentiality and integrity during transmission. This is a common configuration requirement for compliance standards like China's Classified Protection of Cybersecurity (MLPS) 2.0.

5. Application-Based Control

Principle: Modern firewalls can identify specific application types using an application signature library, even if applications use non-standard ports.

Control Method: Configuring rules like "Allow: Web applications, QQ" and "Block: Stock trading, online video" through deep packet inspection and application signature matching.

Application Scenario: In enterprise networks, this restricts entertainment applications to ensure productivity and bandwidth availability. In industrial networks, it can limit unnecessary internet applications to reduce the exposure of industrial control systems.

6. State-Based Control

Principle: This is the most intelligent form of access control. The firewall uses a stateful inspection engine to maintain a connection state table, which records all established, legitimate connections.

Control Method: The first data packet of a new connection undergoes a complete inspection and creates an entry in the state table. Subsequent packets belonging to the same connection are then quickly forwarded without being re-evaluated against every rule. A stateful firewall has "session awareness," dynamically updating the connection state table as packets pass through.

Application Scenario: Stateful inspection is enabled by default on virtually all modern enterprise firewalls. In industrial settings, this technology ensures that firewalls can maintain processing latency at the microsecond level, preventing additional delays in critical industrial control command transmission.

III. Access Control Considerations in Industrial Environments

Implementing access control in industrial IoT environments requires special attention to the following points:

1. Defense-in-Depth Principle

Industrial networks should be segmented into zones with layered isolation. For example, firewalls should be deployed between the office network, the manufacturing execution system (MES) layer, and the operational technology (OT) layer, with strict access control policies to block unnecessary cross-zone traffic.

2. Least Privilege Principle

Whether rules are based on IP, port, or protocol, they should follow the principle of least privilege – allowing only the minimum access necessary for a specific task. For example, an MES server should only be permitted to access specific PLCs on specific ports, not an entire subnet.

3. Centralized Policy Management

In scenarios with multiple factories or numerous distributed sites, access control rules should be deployed centrally via a unified management platform to ensure consistency and auditability.

4. Regular Auditing and Updates

Access control rules are not static. As business needs evolve and threat intelligence updates, rules should be audited regularly for effectiveness—removing obsolete rules and adjusting exceptions to prevent performance degradation and security gaps caused by rule bloat.

IV. Conclusion

Access control is the most foundational and critical line of defense in a network security architecture. From simple port-based filtering to intelligent stateful inspection, these six control rules each have their specific purpose and should be used in combination to build a defense-in-depth strategy.

For industrial networks, understanding and properly configuring these access control rules is essential to effectively isolate security zones, restrict unnecessary device-to-device communication, and protect critical industrial assets from unauthorized access—ultimately ensuring the stable and secure operation of production systems.