Everything you’ve typed lives only in fw’s memory. Restart fw and it’s gone. In this step you prove the policy works, save it as a file, and load it back, the way rules are kept in real life: as code, under version control.
1. Check both clients
2. Save your rules to a file
-t filter saves just the firewall rules (Docker keeps some rules of its own in other tables). The file lands in your captures folder.
3. Compare them with the answer key
The answer key is in the lab folder at config\fw\phase1-rules.v4, with a comment on every rule. This compares just the rules, line by line:
4. Lose them
Restart fw, and look at its rules:
5. Load them back from the file
You should see
- Both checks:
6 passed, 0 failed. - The compare:
MATCH. If not,diffshows the lines that differ:<is the answer key,>is yours. - After the restart:
-P FORWARD ACCEPT. fw is wide open again. - After loading the file: both checks pass again.
What it means
Typed rules are lost on a restart; a file isn’t. With the rules in a file, the firewall can be rebuilt in one command, reviewed before it changes, and compared against what it should be. That’s configuration as code, and it’s how Phase 2 starts: from this file.
Phase 1 done
You’ve watched an open network, read passwords off the wire, reused one, locked the firewall down, opened it for purpose, gone around it, and found blocks in three different firewalls. Phase 2 hides SSH behind a port knock.