Follow these practices when writing firewall rules:
Default deny: Start with "deny all" and add specific permits. Never default to allow.
Least privilege: Only permit what's necessary. If a server needs HTTP, don't permit all TCP.
Document rules: Add comments explaining why each rule exists.
Review regularly: Remove rules for decommissioned systems.
Log denied traffic: Logging helps you detect attacks and troubleshoot.