Firewall / NAT Review Checklist

Checklist discipline. Every item is meant to be answered yes / no with evidence. Items marked critical are non-negotiable; items marked warn are judgement calls; items marked info are baseline expectations.

Items

• Default-deny policy applied to every chain (severity: critical)
• Management allow rule is first in the chain (severity: critical)
• Explicit allow rules for required services (severity: info)
• Stateful filtering consistent with asymmetric routing design (severity: warn)
• Conntrack table sized for expected flow count (severity: info)
• NAT rules use masquerade for dynamic WAN, SNAT for static (severity: info)
• DNAT rules tested with traffic test (severity: warn)
• Hairpin NAT configured where required (severity: info)
• Firewall counters monitored and alerted on anomalies (severity: info)
• Firewall rules reviewed quarterly for staleness (severity: info)

Severity legend

• info: baseline expectation
• warn: judgement call; production-grade depends on context
• critical: non-negotiable; a missed critical item is a release blocker

Evidence retention

The completed checklist is evidence for the change ticket, the audit, and the post-incident review. Store it where it can be recovered if the router is lost.