Rules and best practices

Question

Rules and best practices 
 I will be doing my first project and would like to know what are the basic rules that we need to configure first? I know you need to create DNS, HTTP, HTTPS rule, what else do I need to set up initially? Would you have a document with the best practices, how to create rules, name for standard rules, etc? 
 Thank you very much in advance. Tiago Toledo - tiago.toledo@h9e.com.br - toledotiago@gmail.com - +5511 98311-9506

lferrara · Accepted Answer

Tiago, 
 dealing with security, you should keep in mind "deny by default". Firewall processes rules from top to down and if a single rule is matched, no other rules are checked/processed. 
 Do not create a single rule with multiple ports but try to be specific and clean on your Firewall rules, in order to have a clean situation and managing/editing becomes simple. 
 This is something you will learn with years and you cannot find best practices on Internet. This is something like "how to properly drive a car". You have rules, indicators but it is quite difficult to drive a car with no experience.

lferrara · Answer

Tiago, 
 this is something that you should build on your own. Every Organization has its own requirements. You should investigate on what applications, servers, authentication your customer use. 
 You can use template by filling it in accordance with your customer. For example an excel file with few questions: 
 
 Which application do you want to allow? 
 Which web categories do you wish to allow or deny? 
 Do you host application server? If yes, are they running Apache, IIS, tomcat, etc? 
 Would you like to use authentication on your firewall rules, in order to have reports per users-based? 
 and more... 
 
 First understand what features include XG and then proceed with more questions. 
 For DNS, you should use XG as DNS or DNS forwarder and not use external DNS for best security advice. 
 Regards