# Verified firewall rules by position rather than presence, reading the numbered rule list and the live packet‑filter chain, because a rule that exists is not a rule any packet reaches. 2025 **Situation.** A firewall status listing shows a set of rules. A packet filter evaluates an ordered list and stops at the first match. Those are different things, and the difference is invisible in every tool that prints a summary — which is how the host ran for a year with a rate limit that no packet ever reached, sitting below a broader rule that matched first. **Task.** Firewall verification had to read position rather than membership, because presence had already been demonstrated to prove nothing. **Action.** The checks now read the numbered rule listing and the live filter chain, and assert against order. Exactly one rule exists per port and always with a protocol, because a rule without one silently widens the surface. The SSH port carries a rate limit and never an allow beside it, since an allow above a limit is precisely the shadowing that was found. The declared public surface is a short list of five ports, asserted as a whole rather than checked individually, so a port that appears without being declared fails rather than being noticed. The security report renders the rules in match order with a warning at the top of the section explaining how to read it, because the next person to open that file will otherwise read a set. **Result.** The firewall posture is now checked the way a packet experiences it. The most useful outcome was not the check but what it revealed about the reporting that preceded it: every tool involved had been printing the rate limit for a year, correctly, and none of them had been asked the only question that mattered. --- - Role: Security Engineer - Categories: [Infrastructure](https://engineer.company/categories/infrastructure/), [Automation & CI/CD](https://engineer.company/categories/automation/), [Networking & VPN](https://engineer.company/categories/networking/), [Linux & Servers](https://engineer.company/categories/linux/), [Security](https://engineer.company/categories/security/), [Testing & QA](https://engineer.company/categories/testing/) - Services: [System Administration](https://engineer.company/services/system-administration/), [Networking & VPN Setup](https://engineer.company/services/networking-vpn/), [Security & Access Management](https://engineer.company/services/security-access/)