Default deny policy
A firewall configuration that blocks all traffic by default and only allows specific, explicitly listed connections through. The opposite, and much riskier, approach allows everything by default and tries to block only known bad traffic.
Why this is the recommended default everywhere
A default deny policy fails safely: anything you forgot to explicitly allow simply does not get through, rather than sitting open and unnoticed. The opposite, default allow, fails open, meaning any rule you forgot to write leaves a gap.
What it costs you in practice
Every legitimate service needs an explicit rule before it will work, which means a default deny policy demands you actually know what your server is supposed to be doing. That upfront cost is exactly what makes it effective.
Frequently asked questions
Will a default deny policy break my applications?
Only until you add the explicit allow rules they need, typically for SSH and whichever ports your application serves. It is worth testing carefully after enabling it.
Is default deny only relevant to firewalls?
No, though it is most commonly discussed there. The same principle applies to file permissions, API access and account privileges: start from nothing allowed, then grant only what is specifically needed.
How do I switch an existing server to default deny without an outage?
Add all the allow rules for currently-used services first, verify each one works, and only then change the default policy to deny, rather than doing it in the opposite order.
Want to see where your own server stands?
Run the free, read-only server check, or open the Security Lab and watch the detect, contain, recover, verify loop in action.
Get your free server checkOpen the Security Lab