Network security: walls, tunnels and attacks
Lesson 2 of 6
2Network security: walls, tunnels and attacks
The big pictureMost breaches do not start with a genius breaking encryption, but with a port left open, a default password on a router, or a device on the guest network that can see the company's servers. Network security is, at heart, about order: who may talk to whom, and on which port.
What the picture shows: The firewall reads rules top down, and the first one that matches decides and stops the search. At the end sits an implicit deny for everything not listed.
Map of this part
The concepts in order, click any one to jump to it:
Two ways into the same idea
Think of the network as a building. The firewall is the guard at the gate with a list: "visitors to reception only, staff to the offices, nobody to the vault". The ACL is that list. A VPN is a covered secret corridor from your home to the building that nobody in the street can see into. And attacks are attempts to sneak in: posing as a staff member, or flooding the gate with fake visitors so nobody real gets in.
The three goals, CIA: confidentiality, integrity, availability. A standard ACL matches only the source and sits near the destination; an extended ACL matches source, destination, protocol and port and sits near the source; both end with an implicit deny. A stateful firewall remembers connections and lets replies back automatically, and a next-generation firewall (NGFW) understands applications. VPNs are site-to-site or remote access, using IPsec (IKE then ESP), SSL/TLS or WireGuard. Layer 2 protection: Port Security, DHCP Snooping and Dynamic ARP Inspection. AAA with RADIUS or TACACS+, SSH instead of Telnet, and the guiding ideas of least privilege and zero trust.
Before You Start
📦Ports
Rules are written with addresses and ports.
🔀VLANs
Security starts with separating networks.
The Core Idea
1Confidentiality, integrity, availability
Every security measure protects one of three things. Confidentiality: only the owner can read the data (encryption). Integrity: nobody changes it on the way (signatures and hashes). Availability: the service keeps working (flood protection, backups, redundant links).
2Access control lists (ACLs)
The list is read line by line from the top, and the first line that matches is applied with nothing after it read. So put precise rules first and general ones last. And remember the unwritten last line denies everything.
Move the third rule to the top as ("permit", "any", "any", None) and watch everything pass.
import ipaddress
acl = [ # (action, source, destination, port) read top down, first match wins
("permit", "any", "10.0.10.8/32", 443),
("deny", "10.0.20.0/24", "10.0.10.8/32", 22),
("permit", "10.0.30.0/24", "any", None),
]
def inside(addr, net):
return net == "any" or ipaddress.ip_address(addr) in ipaddress.ip_network(net)
def check(src, dst, port):
for n, (action, s, d, p) in enumerate(acl, start=1):
if inside(src, s) and inside(dst, d) and p in (None, port):
return f"{action} (rule {n})"
return "deny (implicit)"
for packet in [("10.0.20.5", "10.0.10.8", 443), ("10.0.20.5", "10.0.10.8", 22),
("10.0.30.9", "8.8.8.8", 53), ("192.0.2.1", "10.0.10.8", 3389)]:
print(packet, "->", check(*packet))| Type | What it matches | Where it goes |
|---|---|---|
| Standard | The source address only | Near the destination |
| Extended | Source, destination, protocol and port | Near the source |
| Stateful firewall | Like extended, and remembers connections so replies get back | At the network edge |
permit ip any any at the top "so everything works for now". Temporary becomes permanent, and no rule under it is ever read.3VPN: a tunnel through a network you do not own
When you work from a café, every packet goes through the café's network and its provider before reaching your company. A VPN wraps the whole original packet inside a new encrypted one, so anyone on the way sees only that you are talking to the company gateway.
| Type | Connects | Examples |
|---|---|---|
| Site to site | A whole branch to headquarters, always on | IPsec |
| Remote access | One employee from anywhere | SSL/TLS VPN · WireGuard · IPsec |
4Attacks at each layer, and their defence
Every layer has its weak points. Layer 2 matters most because it trusts everyone on the local network: one compromised machine in the department can claim to be the gateway.
Three layer 2 protections and Telnet switched off, as you would type them in Packet Tracer.
SW1(config)# interface range gi0/1 - 20 SW1(config-if-range)# switchport port-security maximum 2 SW1(config-if-range)# switchport port-security violation restrict SW1(config)# ip dhcp snooping SW1(config)# ip dhcp snooping vlan 10 SW1(config)# interface gi0/24 SW1(config-if)# ip dhcp snooping trust ! only the uplink may answer DHCP SW1(config)# ip arp inspection vlan 10 SW1(config)# line vty 0 4 SW1(config-line)# transport input ssh ! no Telnet
Worked example
The task: a guest network 10.0.30.0/24 must reach the internet only, not the staff network 10.0.10.0/24. Write the rules on the guest interface. The answer: a precise deny first, then a broad permit: 10 deny ip 10.0.30.0 0.0.0.255 10.0.10.0 0.0.0.255, then 20 permit ip 10.0.30.0 0.0.0.255 any. In the reverse order guests would reach everything, because the broad rule matches first. Note that Cisco ACLs use the wildcard mask: 0.0.0.255 instead of 255.255.255.0.
Myth vs Reality
| Myth | Reality |
|---|---|
| I have a firewall, so I am protected. | A firewall guards the edge only; an inside threat or a phishing email walks past it. |
| A VPN makes me fully anonymous. | It moves trust from the café to the VPN provider, and does not hide you from sites you sign in to. |
| Attacks always come from outside. | Many start from a compromised inside device, which is why layer 2 protection and zero trust exist. |
Where you meet it at work
🏦Banks
Strict network segments and firewalls between every department.
🏡Remote work
A VPN, or zero-trust access per application.
🧑💼SOC jobs
Security analysts read firewall logs every day, and networking is the base of their work.
Test your understanding
What happens to a packet that matches no line in an ACL?
Every list ends with an unwritten deny.
Where does an extended ACL usually go?
Because it is precise, it stops traffic early before it uses the network.
Which protection stops a device from claiming to be the gateway through ARP?
DAI checks ARP messages against the DHCP snooping table and drops fakes.
Which CIA goal does a DDoS attack hit?
The goal is to stop the service, not to read data.
What is the unwritten last line of every ACL?
The implicit deny: anything not explicitly permitted is denied.
An attack that floods a server with requests from thousands of machines to take it down is:
Distributed denial of service hits availability in the CIA triad.
Quick review cards
Check Your Understanding
Why SSH, not Telnet, for managing devices?
Telnet sends the password in plain text; SSH encrypts everything.
What does least privilege mean?
Every person or device gets only what its job needs, nothing more.
A device on your network starts handing out wrong DHCP addresses. Which protection would have stopped it?
DHCP snooping, because its port is not trusted.
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
Articles2
Done with this lesson?
Sign in to save your progress.