Network defence basics: segments, firewalls, VPN
You draw an organisation’s network with a defender’s eye and learn with examples what firewalls, segmentation, VPNs and network monitoring do against which threats.
Level 101 · 13 lessons · 15 practice labs
Lessons
Seeing the network as a defender
- Defence in depth: one wall is not enough
- Trust zones: internal network, DMZ, management network
- Network inventory: which device is where and who it talks to
- Short task: divide a small office network into zones
Firewalls
- Firewall types: packet filter, stateful, application layer
- Default deny and rule order
- Egress filtering: why controlling inbound alone is not enough
- Rule review: shadowed and overly broad rules
- Short task: find three problems in a faulty rule table
Remote access and monitoring
- VPN basics: an encrypted tunnel with WireGuard
- Management access through a bastion host
- Intrusion detection and prevention: which one when
- Capstone: draw up a defence plan for a branch office network
Practice labs
- Place these devices in the right trust zone: Sort the given device list into internal, DMZ and management networks and write down why.
- Work out who talks to whom from the network inventory: Extract device-to-device flows from connection records and flag the two flows that should not exist.
- Find the door from the DMZ into the internal network: Review inter-zone rules and flows and close the path letting the web server reach the internal database directly.
- Find the overly broad rule in this rule table: Find the rule allowing any port from anywhere and rewrite it in the narrowest form needed.
- Find the shadowed rule and the ordering mistake: Find the rule that never fires in the table, explain why it is shadowed and fix the order.
- Limit outbound traffic to what is needed: Determine the server’s outbound needs from logs, add a default deny and allow only DNS, updates and SMTP.
- Prove the path a harmful flow takes through the rules: Evaluate the rules in order for the given packet, find which one allows it and test the fix.
- Set up a WireGuard tunnel and show traffic is encrypted: Build a tunnel between two ends, ping the inner address and prove you see only encrypted UDP on the outer interface.
- Allow management only from the jump host: Open the servers’ SSH to the bastion address only and show a direct connection fails.
- IDS or IPS: choose the right placement: Choose IDS or IPS for three scenarios on the given network diagram and mark the placement with reasons.
- Cut off the user whose VPN key was stolen: Remove the peer entry from the server, show the session drops and generate a new key pair for the user.
- List the outbound connections this server makes: Extract the destination addresses and ports from an hour of connection records and mark the ones the server needs for its job.
- Restrict egress without breaking updates and DNS: Collect the needed destinations with a logging rule first, build the allow list, deny egress by default and prove package updates still work.
- Match IDS and IPS behaviour to sample situations: Mark for six situations whether the device only alerts or cuts the traffic.
- Design a placement that allows for encrypted traffic and device failure: Choose sensor positions on a three-segment diagram and justify what happens if the inline device fails and where encrypted traffic becomes visible.
About this course
You draw an organisation’s network with a defender’s eye and learn with examples what firewalls, segmentation, VPNs and network monitoring do against which threats.
What you will learn
- Seeing the network as a defender
- Firewalls
- Remote access and monitoring
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.