Network security: ports, firewalls, VPNs and Wi-Fi

Murad set up a small web server at home for the school club. The next morning the log showed thousands of connection attempts on ports 22 and 3389 from addresses he had never seen. Nobody had picked him as a target: scanners probe the whole internet non-stop. In this lesson we learn how to defend a network.

Ports and the attack surface

An IP address is like a building and a port like a door number (0–65535). Behind every open port a service is running, and every service is a potential way in. The sum of all entry points reachable from outside is called the attack surface. The golden rule: close everything you do not need.

Firewalls

A firewall filters traffic by rules: direction, protocol, port, source and destination address. Rules are checked from top to bottom, the first matching rule wins, and the last rule is “deny everything else”. A stateful firewall remembers established connections, so replies to requests you sent get through without extra rules.

import ipaddress

RULES = [
    ('allow', 'tcp', 443, '0.0.0.0/0'),     # HTTPS from anywhere
    ('allow', 'tcp', 22, '10.0.0.0/24'),    # SSH only from the office LAN
    ('deny', 'any', None, '0.0.0.0/0'),     # everything else
]

def decide(proto, port, src):
    for action, r_proto, r_port, r_net in RULES:
        if r_proto not in ('any', proto):
            continue
        if r_port is not None and r_port != port:
            continue
        if ipaddress.ip_address(src) in ipaddress.ip_network(r_net):
            return action
    return 'deny'

for packet in [('tcp', 443, '203.0.113.7'), ('tcp', 22, '10.0.0.15'),
               ('tcp', 22, '203.0.113.7'), ('tcp', 3306, '10.0.0.15')]:
    print(packet, '->', decide(*packet))

('tcp', 443, '203.0.113.7') -> allow
('tcp', 22, '10.0.0.15') -> allow
('tcp', 22, '203.0.113.7') -> deny
('tcp', 3306, '10.0.0.15') -> deny

VPNs and Wi-Fi

A VPN builds an encrypted tunnel between your device and a VPN server (or a company network): it protects traffic on an untrusted network and gives remote access to internal resources. But a VPN does not make you anonymous and does not protect you from phishing or malware; it simply moves your trust from the internet provider to the VPN service. Modern protocols: WireGuard, IPsec, OpenVPN.

In larger networks another key technique is segmentation: the network is split into separate zones (office computers, servers, cameras, guests), and only the traffic that is really needed may cross between zones. Even if a camera is hijacked, the attacker cannot jump from it to the accounting server. At zone borders, IDS/IPS systems detect or block suspicious traffic.

Common attacks and defences

import ipaddress

RULES = [
    ('allow', 'tcp', 443, '0.0.0.0/0'),
    ('allow', 'tcp', 22, '10.0.0.0/24'),
    ('deny', 'any', None, '0.0.0.0/0'),
]
# add a rule for DNS: udp, port 53, office LAN only

def decide(proto, port, src):
    for action, r_proto, r_port, r_net in RULES:
        if r_proto not in ('any', proto):
            continue
        if r_port is not None and r_port != port:
            continue
        if ipaddress.ip_address(src) in ipaddress.ip_network(r_net):
            return action
    return 'deny'

print(decide('udp', 53, '10.0.0.15'))
print(decide('udp', 53, '198.51.100.4'))
print(decide('tcp', 23, '10.0.0.15'))

allow
deny
deny