A firewall rule is a traffic control instruction that tells a firewall whether to allow, block, log, or limit network connections based on conditions such as source IP, destination IP, port, protocol, or interface. Rules are usually processed in order, so placement and exceptions matter as much as the rule content itself.
In cyber security, firewall rules are a core control for shrinking attack surface. They can keep management services like SSH or web admin panels reachable only from trusted networks, preventing internet-wide access to sensitive systems such as routers and servers. Attackers often target weak or missing rules to reach exposed services, while defenders use tight allowlists, default-deny policies, and log monitoring to spot suspicious probes. A poorly designed rule set can silently leave a device exposed even when administrators believe it is protected.