Network Defense Fundamentals: Firewalls, DMZ Architecture, and Network Access ControlEpisode OverviewThis episode introduces the core principles of network defense, focusing on perimeter security, network segmentation, traffic filtering, and access management.The lesson begins with the role of firewalls at network boundaries and examines how organizations separate the public internet, internal networks, and semi-trusted environments such as a Demilitarized Zone (DMZ).You will explore firewall architectures, Access Control Lists (ACLs), packet filtering, stateful inspection, next-generation firewalls, and Web Application Firewalls (WAFs). The episode also introduces network port classifications and explains how source addresses, destination addresses, and service ports contribute to traffic-control decisions.The second major topic is Network Access Control (NAC). NAC extends security beyond the network perimeter by evaluating users and devices before granting network access. The lesson examines agent-based and agentless approaches, in-band and out-of-band deployment models, and dynamic access policies based on identity and environmental conditions.Part I: Perimeter Security and Firewall Architecture1. Understanding Network BoundariesA network boundary defines where one level of trust ends and another begins.A typical enterprise environment may contain several distinct security zones:Internet↓Perimeter Firewall↓DMZ↓Internal NetworkEach zone has a different security purpose.The public internet represents an untrusted environment, the internal network contains more trusted organizational resources, and the DMZ provides a controlled location for services that must be accessible from outside.2. The Demilitarized ZoneA Demilitarized Zone (DMZ) is a segmented network designed to host systems that need controlled external exposure.Typical DMZ systems can include:
- Public-facing web servers. - Reverse proxies. - Mail gateways. - DNS services. - Other externally accessible services. The purpose is to prevent direct internet access to the internal network.A compromise of a public-facing server should not automatically provide unrestricted access to internal systems.This creates a security boundary between:Internet → DMZ → Internal Network3. Triple-Homed Firewall ArchitectureA firewall can use multiple network interfaces to separate different security zones.A triple-homed architecture can provide connections to:
- Internet - Internal Intranet - DMZ Conceptually: Internet | | [ Perimeter Firewall ] / \ DMZ Internal | Network Public-Facing Services The firewall becomes a central enforcement point between the different trust zones.Traffic between these zones can then be controlled according to explicitly defined security policies.4. Access Control ListsAccess Control Lists (ACLs) define which network traffic is permitted or denied.An ACL can evaluate characteristics such as:
- Source IP address. - Destination IP address. - Protocol. - Source port. - Destination port. A simplified rule might conceptually state:Allow → Source A → Destination B → TCP → Port 443while another rule could deny unwanted traffic.The exact syntax and capabilities vary by firewall and network platform.5. Deny by DefaultA fundamental security principle is:Deny by Default → Explicitly Allow Required TrafficInstead of allowing everything and attempting to block known malicious traffic, a restrictive policy permits only the traffic that is required.For example, a public web server may need:
- TCP 443 from the internet. It may not need:
- Arbitrary inbound administrative services. - Unnecessary application ports. - Direct access from untrusted networks to internal databases. A default-deny posture reduces unnecessary exposure and limits the available attack surface.6. Incoming and Outgoing TrafficFirewall policies can control both inbound and outbound traffic.Inbound FilteringControls traffic entering a protected environment.Examples include:
- Internet users accessing a public web service. - External systems connecting to a mail gateway. - Remote administrative connections. Outbound FilteringControls traffic leaving the environment.This can help restrict:
- Unauthorized external connections. - Unapproved applications. - Data-exfiltration paths. - Access to prohibited destinations. Effective perimeter security therefore considers traffic in both directions.7. Understanding Network PortsNetwork services commonly communicate through TCP or UDP ports.Port classifications traditionally include:Well-Known Ports0–1023These are commonly associated with widely used network services.Examples include:
- 22 — SSH - 25 — SMTP - 53 — DNS - 80 — HTTP - 443 — HTTPS Registered Ports1024–49151These can be associated with applications and services registered for particular uses.Port ranges and assignments should be understood as conventions rather than security boundaries by themselves.A firewall should not assume that a service is trustworthy simply because it uses a particular port.Part II: Firewall Inspection Technologies8. Packet FilteringBasic packet filtering evaluates individual packets against predefined rules.The firewall can inspect information such as:
- Source address. - Destination address. - Protocol. - Port number. If the packet matches an allowed rule, it can be forwarded. Otherwise, it can be rejected or dropped according to the policy.This approach is relatively simple but provides limited awareness of the broader connection or application context.9. Stateful InspectionStateful firewalls maintain information about active network connections.Instead of evaluating every packet independently, the firewall can understand whether traffic belongs to an established connection.For example:Client → Server: Connection Request↓Firewall Tracks Session↓Server → Client: ResponseThe firewall can use this state information when deciding whether subsequent packets should be allowed.Stateful inspection therefore provides more context than basic stateless packet filtering.10. Next-Generation FirewallsNext-generation firewalls (NGFWs) extend traditional firewall functionality with additional inspection and security capabilities.Depending on the platform, these can include:
- Application awareness. - User identity integration. - Intrusion prevention. - Advanced traffic inspection. - Threat intelligence integration. - URL filtering. - Malware detection. Rather than relying solely on IP addresses and ports, an NGFW can incorporate additional information when enforcing security policies.11. Web Application FirewallsA Web Application Firewall (WAF) is designed specifically to protect web applications.Unlike a traditional network firewall, a WAF focuses on HTTP and HTTPS traffic and can inspect application-layer requests.It can help detect or block patterns associated with attacks against web applications, depending on its configuration and capabilities.A simplified architecture is:Internet↓Network Firewall↓WAF↓Web ApplicationThe network firewall and WAF therefore address different layers of the security problem.Part III: Network Access Control12. Introducing Network Access ControlPerimeter security controls traffic entering and leaving network zones.Network Access Control (NAC) addresses another question:Should this particular user or device be allowed onto the network at all?NAC can evaluate:
- User identity. - Device identity. - Device security posture. - Authentication status. - Network location. - Policy requirements. The objective is to prevent unknown, unauthorized, or non-compliant devices from receiving unrestricted network access.13. Device Health and Security PostureNAC systems can evaluate the security condition of connecting devices.Depending on the implementation, posture information may include:
- Authentication status. - Operating-system information. - Security software status. - Configuration requirements. - Device compliance. - Other organizational security requirements. A device that fails the organization's requirements may be:
- Denied access. - Placed into a restricted network. - Redirected for remediation. - Granted limited access. This creates a relationship between identity, device posture, and network access.14. Agent-Based AuthenticationAn agent-based NAC approach can use software or endpoint mechanisms to participate in authentication and policy enforcement.A common enterprise example is 802.1X, which provides port-based network access control.The general process can be represented as:Endpoint↓Network Access Device↓Authentication Service↓Access DecisionThe authentication infrastructure can then determine whether the endpoint should receive network connectivity and what level of access should be provided.15. Agentless and Browser-Based AccessNot every device can run an NAC agent.Public networks, guest environments, smartphones, and unmanaged devices may require an agentless approach.One common model uses a browser-based portal:Connect to Network↓Authentication / Captive
Podden och tillhörande omslagsbild på den här sidan tillhör
CyberCode Academy. Innehållet i podden är skapat av CyberCode Academy och inte av,
eller tillsammans med, Poddtoppen.
