As a more corpose vulnerability assessment and penetration test, one step of our activity is to review from a security perspective the policy of some firewall. 

In our society we have a deep understanding of firewall rule and best practice but we don't have any standard reference for commercial purpose and we don't know guidelines to explain security concern about misconfiguration and best practice to the client and to add more value to our know-how. 

In out little research about it we found from the NIST this guidelines:   

**Guidelines on Firewalls and Firewall Policy**  

 Recommendations of the National Institute of Standards and Technology  

[Special Publication 800-41 Revision 1](http://csrc.nist.gov/publications/nistpubs/800-41-Rev1/sp800-41-rev1.pdf)

Is there other reference about firewall policy and firewall configuration? Any suggestion?

The target client is a public Library, in Italy.   

I don't think there is some specific rule about firewall as we have, for example, for privacy stuff.