Perimeter and Boundary Defense
Questions here focus on what separates trusted from untrusted networks, and on the configuration details that decide whether a boundary actually holds: rule order, statefulness, DMZ design, remote access, and egress.
Core rules
- Firewall generations differ. Packet filters see headers only; stateful firewalls track the connection table; proxies terminate and inspect at Layer 7; NGFWs add application identification, TLS inspection, and IPS.
- ACLs evaluate top-down, first match wins, with an implicit deny at the end. A specific permit placed below a broad deny is a shadowed rule and never fires.
- Default-deny ingress is table stakes; default-deny egress is what stops command-and-control and exfiltration.
- DMZ design: internet-facing services sit in a segment that can reach them but that cannot initiate connections into the internal network. Two-firewall and single-firewall three-interface topologies both implement this; the rule set matters more than the box count.
- NAT/PAT hides addressing, not services. Every port forward you publish is a hole you own.
- Remote access needs MFA, a deliberate split-tunnel decision, and logging. Full tunnel with no posture check is a lateral-movement highway.
- The boundary is not only the internet edge: wireless (WPA3-Enterprise with 802.1X, rogue AP detection), NAC on wired ports, and VPN concentrators are boundaries too.
Worked example
Design the rules for a public web application with a database behind it.
Reasoning: inbound from any source to the WAF public address on 443/tcp only - not 80, and not directly to the web server. WAF to web server on 443. Web server to database on 1433/tcp with both source and destination restricted to the specific hosts. Explicit deny and log everything else, including any traffic from the internet to the database subnet. Because the firewall is stateful, return traffic needs no separate rule; a common distractor is adding a reverse rule for replies. Egress from the web tier is denied except to the patch repository, which prevents a compromised server from reaching arbitrary external addresses over 443. Log the denies at the boundary; they are your early-warning feed.
Traps
- "Any-any" rules added during an outage to make things work and never removed.
- Assuming an IPS blocks encrypted malicious traffic without decryption or metadata analysis.
- Forgetting outbound DNS and ICMP in the egress policy, then wondering why monitoring is blind.
- Believing VPN authentication establishes authorization to the entire internal network.
- Confusing a WAF with a network firewall: it protects HTTP semantics only.