Firewalls & Network Segmentation

Relax. We'll talk through this in plain words — no textbook voice.

What you'll walk away with

Understand Firewalls & Network Segmentation well enough that it stops being intimidating
Get hands-on running the tools yourself in an authorized lab environment
Be able to apply this concept immediately in a real assessment or report

Let's think about it this way for a second

A firewall is a device or piece of software that filters network traffic based on rules (allow/deny) — you configure inbound rules (what traffic is allowed in) and outbound rules (what traffic is allowed out), and default-deny (only explicitly allow what's needed) is accepted as best practice. Network segmentation, meanwhile, means dividing the whole network into zones (a public-facing web server zone, an internal database zone, an admin zone). Even if an attacker compromises one zone, segmentation stops them from immediately moving laterally into other zones (similar in concept to Kubernetes Security Groups or AWS VPC subnets).

Let's connect it to a real-world scenario

Say a company network puts its web server in a 'DMZ' (Demilitarized Zone, public-facing) and its database in an 'internal' zone, with a firewall rule that only allows 'DMZ → internal, database port only' — even if the web server gets compromised, the attacker can't connect directly to the database server, since only that specific port/protocol is allowed. If you remember the Security Group/VPC subnet concept from the Terraform tutorial, you'll immediately see the connection here.

Firewall = a device/software that filters network traffic based on rules (default-deny is best practice)
Network Segmentation = dividing a network into zones (to limit lateral movement)
Even if one zone gets compromised, segmentation keeps other zones from being directly affected

Let's look at it together

text

Simple network segmentation model:

Internet
   |
[Firewall] -- allow 443 only
   |
[DMZ: web server]
   |
[Firewall] -- allow DB port from web server only
   |
[Internal: database server]

If the web server is compromised, the attacker still
can't reach anything except what the DMZ->Internal rule
explicitly allows.

You should see

You'll be able to explain the defensive value of firewalls and network segmentation with an example.

Try it in 5 minutes

Design a set of firewall rules yourself for a 3-tier architecture (Web/App/Database — reference the Terraform/AWS tutorial if you remember it), specifying exactly which tier can reach which tier on which port.

A quick word of caution

Be careful when changing firewall rules in a production environment — you could accidentally block legitimate traffic. Test the change in a maintenance window or staging environment first before applying it to production.

Easy traps

Setting a firewall rule to 'allow all' (0.0.0.0/0, every port) and feeling satisfied that 'we have a firewall now' — if the rule isn't properly scoped, having a firewall is basically the same as not having one
Skipping network segmentation because 'it's a hassle to set up' — on a flat network (no segmentation), if an attacker gets a single entry point, they can immediately reach the entire network

Now try it yourself

You'll know it worked when: You'll be able to explain the defensive value of firewalls and network segmentation with an example.