The Principle of First-Match Parsing
The most critical concept in firewall architecture is '[First-Match](/tools/firewall-validator/firewall-rule-order-proofs)'. Firewalls parse Access Control Lists (ACLs) sequentially from top to bottom. The very first rule that successfully matches a packet's metadata (source IP, destination IP, protocol, and port) dictates the firewall's action (Pass, Block, or Reject).
Once a match is made, the firewall stops parsing the rest of the list. Any rules below the matching rule are completely ignored for that specific packet.
What is Rule Shadowing?
Rule shadowing is a severe logical vulnerability that occurs when a broad rule is placed higher in the ACL than a narrower, more specific rule.
Because of [First-Match](/tools/firewall-validator/firewall-rule-order-proofs) parsing, the broad rule intercepts all traffic that the specific rule was meant to handle. The specific rule becomes 'shadowed'—it is effectively dead code and will never be evaluated.
Example of Shadowing Vulnerability:
- **Rule 1 (Top):** `Pass Protocol TCP Source Any Destination Any Port 80`
- **Rule 2 (Bottom):** `Block Protocol TCP Source 192.168.1.50 Destination Any Port 80`
In this scenario, a network administrator intended to block IP `192.168.1.50` from accessing web traffic (Rule 2). However, because Rule 1 broadly permits all HTTP traffic and sits above Rule 2, the firewall will pass the malicious traffic and never reach the block command.
Redundancy vs. Shadowing
It is important to distinguish between shadowing and redundancy:
- **Shadowing:** A broad rule neutralizes a specific rule, potentially creating a massive security hole.
- **Redundancy:** A rule is identical to, or narrower than, a rule above it that executes the *same action*. While redundancy doesn't alter the security policy, it bloats the firewall table, consuming CPU cycles and slowing down packet throughput.
Mitigation Strategy
To prevent shadowing, always structure your ACLs from most specific at the top to most general at the bottom. Deny rules targeting specific malicious IPs should sit near the very top of the list.