FIREWALL LAB - See What the Firewall Sees

Packet Filtering Mode CONNECTION MEMORY: NONE

Inject:

FIREWALL

💡 Watch packets flow above • Inspect live headers & rule decisions in X-Ray below Active Packets: 0

PACKET X-RAY & FIREWALL INSPECTION ENGINE ID: #0000

WAITING FOR TRAFFIC

1. EXTRACT HEADERS

Source IP: ---

Dest IP: ---

Protocol: ---

Src/Dst Port: ---

TCP Flags: ---

2. CHECK STATE & RULES

State Memory: NO SESSION

Rule Evaluated: Evaluating...

Rule Logic: Top-to-Bottom First Match

3. L7 & VERDICT REASON

App ID: ---

Malware Scan: CLEAN

Ready for next packet arrival...

Header Field Inspection Breakdown (Highlighted fields = Visible to current Firewall Mode)

ETHERNET HEADER (Layer 2) 64-bit frame

SRC MAC ADDRESS 00:1A:2B:3C:4D:5E

DEST MAC ADDRESS 00:1A:2B:99:88:77

IP HEADER (Layer 3) INSPECTED BY CURRENT FIREWALL

SOURCE IP 203.0.113.45

DESTINATION IP 10.10.10.25

PROTOCOL TCP (6)

TTL / CHECKSUM 64 / 0x4f32

TRANSPORT HEADER (Layer 4) INSPECTED BY CURRENT FIREWALL

SOURCE PORT 51544

DEST PORT 443 (HTTPS)

TCP FLAGS SYN

SESSION STATE NEW CONNECTION

APPLICATION DATA & PAYLOAD (Layer 7) BLIND SPOT FOR STATELESS FIREWALL

APPLICATION IDENTIFICATION HTTPS / Malicious Payload

THREAT: CRITICAL

RAW PAYLOAD SNIPPET POST /api/v1/download HTTP/1.1\r\nHost: malicious-command-center.xyz\r\n\r\n[Trojan.Win32.Agent Binary Signature]

OSI Model Inspection Coverage Matrix

See which network layers are analyzed by the currently active firewall technology.

Packet Filtering Firewall

Application Layer

HTTP, HTTPS, SSH, DNS, FTP, SMTP, Malware Signatures, Payload Data

BLIND SPOT (Ignored)

Presentation Layer

TLS/SSL Decryption, Character Encoding, Encryption Inspection

BLIND SPOT (Ignored)

Session Layer

TCP Handshake Verification, RPC Sessions, Socket Handshakes

BLIND SPOT (Ignored)

Transport Layer

Source/Dest TCP & UDP Ports (80, 443, 22), TCP Flags (SYN, ACK, FIN)

INSPECTED

Network Layer

Source IP, Destination IP, IPv4 Header, ICMP, Routing

INSPECTED

L1-2

Data Link & Physical Layer

MAC Addresses, Ethernet Frames, Network Interface Cards, Cables

PASSTHROUGH

Interactive Cybersecurity Lab Scenarios

Practice real firewall configurations and analyze common administrator misconfigurations.

Scenario 1: The First-Match Trap

Rule Order Error

Administrator added ALLOW ANY ANY at Rule 1, then attempted to block SMB Ransomware (Port 445) at Rule 2.

Scenario 2: Return Traffic Puzzle

Stateless vs Stateful

Observe why web browsing breaks in Stateless mode without inbound rules, but works instantly in Stateful mode via the State Table.

Scenario 3: Port 443 Malware Stealth

NGFW Deep Inspection

Malware tries to disguise itself over Port 443 (HTTPS). Compare traditional L4 firewall vs NGFW Deep Inspection.

Scenario 4: Secure Admin Subnet

ACL Policy

Configure ACLs to restrict SSH (Port 22) strictly to the Admin Workstation (192.168.1.10) while blocking public internet SSH.

FIREWALL LAB CERTIFICATION EXAM

15 SCENARIOS • PASSING: 80% (12/15)

Demonstrate mastery of packet inspection, state memory, NGFW deep scans, and rule policy engineering.

PROGRESS: Scenario 1 of 15

CURRENT SCORE: 0 / 15

KABLE ACADEMY NETWORK SECURITY LAB ENGINE

VERIFIED OFFICIAL CREDENTIAL

OFFICIAL CERTIFICATE OF COMPLETION

FIREWALL SECURITY & INSPECTION SPECIALIST

This credential certifies that the candidate has successfully passed the comprehensive 15-stage Firewall Engineering Laboratory Exam, proving technical competency in Layer 3/4 Packet Inspection, Dynamic Session State Tracking, Application Proxy Analysis, NGFW Deep Payload Inspection, and Rule Base Policy Engineering.

ENTER YOUR FULL NAME FOR CERTIFICATE PRINTING:

PROUDLY PRESENTED TO: Jane Doe

EXAM SCORE: 15 / 15 (100%)

GRADE STATUS: PASSED WITH DISTINCTION

DATE ISSUED: September 29, 2026

VERIFICATION HASH: FWLAB-CERT-2026-98742

Active Rule Policy

Evaluated TOP TO BOTTOM (First Match Wins)

DEF

DENY ALL OTHER TRAFFIC Implicit Default Security Policy

FINAL FALLBACK

Dynamic State Table Connection Memory

Tracks established TCP 3-way handshakes. Return packets matching active sessions bypass rule re-evaluation!

Source IP:Port	Dest IP:Port	Proto	State
No active connection sessions in state memory.

Live Inspection Audit Log

Waiting for network traffic...

PACKET X-RAY & FIREWALL INSPECTION ENGINE ID: #0000

OSI Model Inspection Coverage Matrix

Application Layer

Presentation Layer

Session Layer

Transport Layer

Network Layer

Data Link & Physical Layer

Interactive Cybersecurity Lab Scenarios

Scenario 1: The First-Match Trap

Scenario 2: Return Traffic Puzzle

Scenario 3: Port 443 Malware Stealth

Scenario 4: Secure Admin Subnet

FIREWALL LAB CERTIFICATION EXAM

FIREWALL SECURITY & INSPECTION SPECIALIST

Active Rule Policy

Dynamic State Table Connection Memory

Live Inspection Audit Log

Configure Firewall Rule

TERM NAME