A fresh NG Firewall routes first and judges later. Day one is not about building a fortress — it is about understanding the default posture, learning how rules are read, and adding three careful rules you can prove.
Here is the fact new admins most often get wrong: installing NG Firewall does not mean everything is blocked until you allow it. The Firewall app starts from a permissive posture — its job in the rack is to enforce the specific block and pass rules you write, evaluated in order. That makes day one a teaching moment, not a lockdown moment. Add rules one at a time, prove each from a real client PC, and keep a way back. Filtering by website category, malware and application lives in other apps (the companion pages cover those) — this page is only about the Firewall app's own rules.
Out of the box, the gateway routes traffic and the Firewall app does not silently block your users' normal work. That is deliberate: a gateway that blocks everything on day one gets unplugged by lunchtime. The security on a fresh install comes from being a NAT gateway at all (unsolicited inbound traffic has no path to your PCs), from the apps you enable, and from the rules you now add deliberately. Anyone who tells you 'install it and you are protected' is skipping this page.
Firewall rules are evaluated top to bottom, first match wins. The first rule whose conditions match a connection decides its fate; later rules never see it. Two habits follow from that. Put specific rules (one host, one port, one network) above broad rules. And when a rule 'does not work', the answer is usually above it — something broader matched first. Read the list like a waterfall, not a checklist.
You have now proven the full loop — write, match, observe — on traffic nobody cares about. Every serious rule later is this same loop with higher stakes.
The most valuable early rule is about the box's own front door. Your admin console should be reachable from the internal management side only — never something the whole network, and certainly never the internet side, can knock on. If you run a guest or student network through this gateway, add a rule blocking that range from reaching the gateway's administration. Test it from the guest side (it must fail) and from your admin PC (it must still work) before you trust it.
Locking yourself out of a gateway is a rite of passage, but it is an optional one. The discipline above is the entire difference between 'the firewall guy' and 'the person who broke the internet'.
See the Firewall app and its rules handled live in the setup video before you write your own.
▶️ Watch Full VideoThe gateway's NAT already stops unsolicited inbound connections from reaching your PCs, but the Firewall app itself starts permissive — it enforces the block and pass rules you write, in order. Real content filtering comes from apps such as Web Filter and Intrusion Prevention, which are enabled separately.
Top to bottom, and the first matching rule wins. Specific rules for single hosts or ports belong above broad rules, and when a rule seems ignored, an earlier rule has usually already matched the same traffic.
A block rule between one test PC and one harmless destination. It proves the whole write-match-observe loop with zero risk to production traffic, and it teaches you where hit counts and rule ordering live before the stakes are real.