Network Security
Firewalls, VPNs and Defence in Depth
Examines each packet independently: source and
JrCodex·9 min read
Jr Codex Computer Networks Notes
Level: Intermediate–Advanced Prerequisites: Chapter 3: TLS and HTTPS Time to complete: ~20 minutes
Table of Contents
- Firewalls
- Writing Rules
- VPNs
- The Perimeter Model and Its Failure
- Zero Trust
- DDoS
- Summary & Next Steps
1. Firewalls
Three Generations
─────────────────────────────────────────
PACKET FILTER (stateless)
Examines each packet independently: source and
destination IP, port, protocol.
+ fast, simple
- cannot tell a reply from an unsolicited
packet, so allowing replies means allowing
everything from that port
STATEFUL INSPECTION
Tracks CONNECTIONS. An inbound packet is
allowed if it belongs to a connection this side
initiated.
── the same asymmetry as NAT (Module 3,
Chapter 5), and the standard today
APPLICATION LAYER (layer 7)
Understands HTTP, DNS, SMTP. Can block a URL
path, inspect a request body, enforce a schema.
+ far more precise
- slower, must decrypt TLS to see anything,
and protocol-specific
─────────────────────────────────────────
Why Stateful Changed Everything
─────────────────────────────────────────
A stateless filter allowing return traffic must
permit anything with a source port of 80.
An attacker sets their source port to 80 and
walks straight through.
A stateful firewall knows there is no established
connection matching that packet, and drops it —
without needing any rule about port 80 at all.
─────────────────────────────────────────
2. Writing Rules
# nftables — the modern Linux firewall.
nft add table inet filter
nft add chain inet filter input '{ type filter hook input priority 0; policy drop; }'
# 1. Established connections — the stateful rule that makes everything else work.
nft add rule inet filter input ct state established,related accept
# 2. Loopback.
nft add rule inet filter input iif lo accept
# 3. Explicitly permitted services.
nft add rule inet filter input tcp dport { 22, 80, 443 } ct state new accept
# 4. ICMP — RATE LIMITED, not dropped (Module 3, Chapter 5).
nft add rule inet filter input ip protocol icmp limit rate 10/second accept
nft add rule inet filter input ip6 nexthdr icmpv6 limit rate 10/second accept
# Everything else hits the default policy: drop.THE THREE PRINCIPLES
─────────────────────────────────────────
DEFAULT DENY
Deny everything, then permit what is needed.
The inverse — permit everything, deny known
bad — fails against anything you did not think
of, which is the entire problem.
ALLOW ESTABLISHED FIRST
One rule handles all return traffic. Without
it you would need a mirrored rule per service.
DO NOT BLOCK ALL ICMP
Module 3, Chapter 5's warning. Rate limit it.
Blocking it breaks path MTU discovery and
produces the hang-on-large-transfers failure
that nobody diagnoses quickly.
─────────────────────────────────────────
Ingress and Egress
─────────────────────────────────────────
Most firewalls are configured for INBOUND traffic
only. EGRESS filtering — restricting what may
leave — is neglected and valuable:
- a compromised server cannot exfiltrate to
arbitrary destinations
- malware cannot reach its command and control
- it catches misconfiguration, like a service
calling an unexpected external API
If a database server needs no outbound internet
access, deny it. This limits the blast radius of
a compromise rather than preventing it —
Chapter 1's defence in depth.
─────────────────────────────────────────
3. VPNs
What a VPN Actually Does
─────────────────────────────────────────
Creates an encrypted TUNNEL: your packets are
encapsulated inside encrypted packets to the VPN
server, decapsulated there, and forwarded on.
It is Module 1, Chapter 3's encapsulation, with
an encryption layer inserted.
[outer IP | encryption | INNER IP | TCP | data]
└─ your original
packet ─┘
─────────────────────────────────────────
The Two Genuine Uses
─────────────────────────────────────────
REMOTE ACCESS
Reach an internal network from outside as
though attached to it.
── the original and still primary purpose
SITE-TO-SITE
Join two offices' networks over the internet.
─────────────────────────────────────────
The Protocols
─────────────────────────────────────────
WIREGUARD modern, ~4,000 lines of code, fast,
simple to configure, uses current
cryptography only.
The default recommendation.
IPSEC standardised, ubiquitous in
enterprise hardware, complex to
configure correctly.
OPENVPN runs over TCP or UDP, very portable,
slower than WireGuard.
WireGuard's small codebase is a security
argument, not just an aesthetic one: less code
is less attack surface, and it is auditable by
one person.
─────────────────────────────────────────
WHAT A CONSUMER VPN DOES AND DOES NOT DO
─────────────────────────────────────────
DOES
Hides your traffic from the LOCAL network and
your ISP.
Hides your real IP from the sites you visit.
Lets you appear to be in another country.
DOES NOT
Make you anonymous — you log into accounts.
Protect against tracking cookies or browser
fingerprinting.
Protect against malware or phishing.
Add protection to sites already using HTTPS,
which is nearly all of them.
IT MOVES TRUST, IT DOES NOT ELIMINATE IT.
You stop trusting your ISP and start trusting
the VPN provider — who now sees everything your
ISP would have.
For a specific need — reaching an internal
network, or hostile local wifi — a VPN is the
right tool. As a general privacy measure it is
substantially oversold.
─────────────────────────────────────────
4. The Perimeter Model and Its Failure
The Traditional Model
─────────────────────────────────────────
A hard shell, a soft interior.
INTERNET ──[ firewall ]── INTERNAL NETWORK
│
everything inside is TRUSTED
Authenticate at the perimeter. Once inside, you
can reach everything.
─────────────────────────────────────────
Why It Stopped Working
─────────────────────────────────────────
NO CLEAR PERIMETER ANY MORE
Cloud services, SaaS, remote work, personal
devices. Where is "inside"?
LATERAL MOVEMENT
One compromised laptop is now inside. The soft
interior means an attacker moves freely from
there — and this is how essentially every large
breach unfolds.
INSIDERS
The model gives no protection against someone
already inside.
VPNs MADE IT WORSE
A VPN puts a remote device INSIDE the trusted
zone. Compromise that device and the attacker
inherits full internal access.
─────────────────────────────────────────
5. Zero Trust
The Principles
─────────────────────────────────────────
NEVER TRUST, ALWAYS VERIFY
Network location grants NOTHING. A request from
the office LAN is treated exactly like one from
a café.
VERIFY EXPLICITLY
Every request authenticated and authorised,
using identity, device posture and context.
LEAST PRIVILEGE
Access to specific applications, not to the
network. Chapter 1's principle.
ASSUME BREACH
Segment, monitor, and limit blast radius,
because compromise is expected rather than
hypothetical.
─────────────────────────────────────────
What It Looks Like in Practice
─────────────────────────────────────────
IDENTITY-AWARE PROXY in front of each
application, rather than a VPN into the network
mTLS between services — both sides present
certificates (Chapter 3), so a service
authenticates its caller
MICRO-SEGMENTATION — services can reach only the
specific services they need
SHORT-LIVED CREDENTIALS — minutes, not months
CONTINUOUS VERIFICATION — re-evaluate rather than
authenticate once at a session's start
─────────────────────────────────────────
The Honest Assessment
─────────────────────────────────────────
Zero trust is a DIRECTION, not a product,
regardless of what vendors say.
It is genuinely better: it removes the "inside is
safe" assumption that every large breach has
exploited.
It is also a substantial engineering effort, and
most organisations are partway. The valuable part
is the mental shift — stop treating the network
as a security boundary — which you can adopt
before any of the tooling.
─────────────────────────────────────────
6. DDoS
The Categories
─────────────────────────────────────────
VOLUMETRIC
Saturate the link. Measured in Gbps or Tbps.
UDP floods, amplification.
PROTOCOL
Exhaust connection state rather than bandwidth.
SYN floods (Module 4, Chapter 3).
APPLICATION LAYER
Few requests, each EXPENSIVE. A search query
that scans everything, a report that aggregates
millions of rows.
Hardest to detect — the traffic looks
legitimate, because it is.
─────────────────────────────────────────
AMPLIFICATION — why spoofing matters
─────────────────────────────────────────
1. Send a SMALL query with a SPOOFED source
address (the victim's)
2. The server sends a LARGE reply — to the victim
3. Repeat across thousands of servers
AMPLIFICATION FACTORS
DNS up to ~54x
NTP up to ~556x
memcached up to ~51,000x
A 1 Gbps attacker generates 51 Tbps of traffic at
the victim.
THE ROOT CAUSE IS IP SPOOFING, which BCP 38
ingress filtering at every network edge would
largely eliminate. Deployment remains incomplete
decades after it was specified.
─────────────────────────────────────────
Defences
─────────────────────────────────────────
CAPACITY more bandwidth than the attack.
Expensive, and what a CDN
provides (Module 7, Chapter 2).
ANYCAST one address announced from many
locations, so an attack is
distributed across all of them
rather than concentrated.
RATE LIMITING per IP, per user, per endpoint.
SCRUBBING traffic routed through a filtering
provider during an attack.
SYN COOKIES for protocol attacks (Module 4,
Chapter 3).
APPLICATION cache aggressively, cap expensive
DESIGN operations, require auth for
costly endpoints, paginate
everything.
─────────────────────────────────────────
Do Not Contribute to the Problem
─────────────────────────────────────────
□ No open DNS resolvers (Module 5, Chapter 1)
□ No NTP servers with monlist enabled
□ memcached and Redis bound to localhost, never
the public internet
□ Implement BCP 38 ingress filtering if you
operate a network
□ Rate limit anything that returns more than it
receives
Most amplification traffic comes from
misconfigured servers whose operators do not know
they are participating.
─────────────────────────────────────────
7. Summary & Next Steps
Key Takeaways
- Stateful firewalls track connections, so one "allow established" rule handles all return traffic and an attacker cannot walk in by setting a source port.
- Default deny is the only workable posture, and egress filtering — rarely configured — limits what a compromised host can do.
- A VPN moves trust from your ISP to the VPN provider rather than eliminating it, and adds little to connections already using HTTPS.
- The perimeter model fails because there is no perimeter and its soft interior enables lateral movement; zero trust's core insight is that network location must grant nothing.
Module 6 Complete — What's Next
You now understand what an attacker can do and what defends against it. Module 7 turns to how large systems are actually built today — load balancers, CDNs, cloud networks and service meshes — all of which are shaped by the constraints of every previous module.
Concept Check
- Why can an attacker walk through a stateless firewall that permits return traffic from port 80?
- What does a consumer VPN protect against, and what does it not?
- Why is IP spoofing the root cause of amplification attacks, and what would largely fix it?
Next Module
→ Module 7: Modern & Distributed Networking
Jr Codex — 1-on-1 Personalized Coaching | Back to Module Index | Back to Computer Networks Index