---
title: "Deny all traffic unless a rule allows it · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/networking-and-dns/deny-by-default-firewall
updated: 2026-10-20
licence: "All rights reserved"
---

# Deny all traffic unless a rule allows it

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Networking and DNS](https://agentwranglers.se/playbook/infrastructure/networking-and-dns)
- Rule: Start every security group and firewall from deny. Allow only named ports from named sources, and open a port to the whole internet only on the load balancer.
- How: Write each allowed path as its own rule in code. Point rules at other security groups instead of address ranges where you can. Only the public load balancer takes `0.0.0.0/0` and `::/0`, and only on ports 80 and 443. Remove the default rules a new network comes with.
- Check: The query below finds no rule open to the internet on any port but 80 or 443. Rules open on 80 or 443 belong only to the load balancer's security group. A policy scan fails a pull request that adds one.

Example:

```sh
# Lists rules open to the internet on ports other than 80 and 443. Expect nothing.
aws ec2 describe-security-group-rules --query \
  'SecurityGroupRules[?IsEgress==`false` && (CidrIpv4==`0.0.0.0/0` || CidrIpv6==`::/0`) && !(FromPort==`443` && ToPort==`443`) && !(FromPort==`80` && ToPort==`80`)].[GroupId,FromPort,ToPort]' \
  --output text
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/networking-and-dns/deny-by-default-firewall`.

- Previous: [Keep databases in private subnets](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/private-data-stores)
- Next: [Close admin ports to the internet](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/no-public-admin-ports)
- [Networking and DNS](https://agentwranglers.se/playbook/infrastructure/networking-and-dns)