Lesson 5.13: Firewalls and segmentation: deciding which traffic may pass
What firewalls do and where they sit (on a host, at the network edge, between zones), default-deny rule sets, stateful filtering, network zones such as a DMZ, and why traffic between internal zones matters as much as traffic from the internet. In the lab you take a web server that exposes SSH and its database to the whole internet, write a default-deny policy that leaves the website open and SSH reachable only from the admin network, and check the result from the internet's point of view.
19 min
You will learn to
- Explain host and network firewalls
- Write a default-deny rule set with specific exceptions
- Limit a service to one source network
- Verify firewall rules from the outside
- Explain zones, the DMZ and east-west traffic
Key terms
- Firewall
- A control that allows or blocks traffic according to rules: source, destination, port, protocol and more.
- Host and network firewall
- A host firewall runs on one machine (ufw, Windows Defender Firewall); a network firewall sits between networks and protects many machines at once.
- Default deny
- A rule set that blocks everything except what is explicitly allowed.
- Stateful firewall
- Remembers connections, so replies to traffic you started are let back in without separate rules.
- Zone and DMZ
- A zone is a group of systems with the same trust level. The DMZ (demilitarised zone) holds servers that must be reachable from the internet, kept apart from the internal network.
- East-west traffic
- Traffic between systems inside the network, as opposed to north-south traffic to and from the internet.
← Changing users: su and sudo · All lessons · Responsible disclosure, bug bounties and security.txt →