Study Guide
Firewalls, Traffic Filtering and Segmentation
What a firewall checks, how rules are evaluated, why stateful filtering and default deny matter, and how segmentation uses firewalls to control traffic between zones.
Lesson 4.2 Network & Infrastructure Security
Routers and switches are built to deliver traffic, not to judge it. Left alone, a network will carry a request from a visitor’s phone to a staff records server just as happily as a teacher’s request. Firewalls add the missing judgement: they decide which traffic is allowed to pass. This lesson explains how they make that decision and how dividing a network into zones gives them a place to do it.
Stage: Think
The reception desk
A school reception desk decides who may go where. Its instructions are a short list, read from the top:
- Staff may go to any room.
- Parents may go to the hall.
Think it through
- Hint 1: Would it be possible to write down every person who must be kept out?
Show the answer
Answer: A. Turn them away: nobody has said that drivers may go anywhere.
A safe list says who is allowed, and refuses everyone else. Nobody could list every person who must be kept out.
Think it through
Show the answer
Answer: B. Any room, because the first line that fits them says so.
When a list is read from the top and the first line that fits decides, a broad line placed too high makes the lines below it pointless.
A network firewall works in exactly this way: a short list of what is allowed, read from the top, with everyone else refused. The rest of the lesson shows how.
Stage: Explain
Why firewalls keep coming up
Firewalls come up in security from several angles:
- Device security: enabling and correctly configuring firewalls is among the basic practices that improve device security.
- Baseline schemes: firewalls are one of the five technical control areas of Cyber Essentials, the UK baseline scheme.
- Networking: NAT is not a firewall and is not a substitute for one.
Those points establish that firewalls matter. The rest of this lesson explains how they actually decide what to allow.
Stage: Explain
Where firewalls sit
A firewall is a control that decides which network traffic may pass. It can only judge traffic that passes through it. There are two common placements:
| Type | Where it runs | What it protects |
|---|---|---|
| Host firewall | Software on one device, such as the firewall built into Windows or Linux. | That device, including from other devices on its own network. This is the firewall that everyday device-security advice refers to. |
| Network firewall | A dedicated device, or a feature of a router, placed where traffic passes between networks. | Every network behind it, but only for traffic that actually crosses it. |
Check your understanding
Show the answer
Answer: A. No: that traffic never crosses it; a host firewall can stop it.
Traffic between two devices on the same network does not cross the edge firewall, so only the laptops’ own host firewalls can filter it.
The two work together. A network firewall cannot see traffic between two laptops on the same network; each laptop’s host firewall can.
Stage: Explain
What a firewall checks
A traditional firewall reads the headers that the network models lesson described, not the application data inside. For each packet it can check:
- Source and destination IP addresses: where the packet comes from and where it is going. See IPv4 and IPv6 Addresses.
- Protocol: for example TCP or UDP.
- Source and destination port numbers: which service is being asked for. TCP 443 is HTTPS; TCP 3389 is Windows Remote Desktop. See TCP, UDP, Ports and Sockets.
- Direction and interface: whether the packet is arriving from the internet side or from an internal network.
A firewall rule combines some of these conditions with an action, allow or deny. “Allow staff devices to reach the records server on TCP 443” is a rule. Firewall rules express the same idea as least privilege: permit only the traffic a legitimate task needs.
Stage: Predict
First match wins, then default deny
Most firewalls check rules from the top of the list down. The first rule whose conditions all match decides what happens, and the firewall stops checking. If no rule matches, a final default rule applies. In a well-designed policy that default is deny, so only traffic someone deliberately allowed can pass. This is called default deny: the reception desk turning away anyone not on the list.
Think it through
Show the answer
Answer: B. It is denied by the default rule.
It is denied by the default rule, because no rule allows it. The walkthrough checks it rule by rule.
A visitor’s phone on the guest network tries to open the records system: Guest → Records server · TCP 443. The firewall compares it with each rule in turn, checking From, To and Service.
- Rule 1: Allow Staff → Records server · TCP 443. From is Staff; the phone is Guest. No match, so the firewall moves on.
- Rule 2: Allow Staff → Internet · TCP 443. From is Staff again. No match.
- Rule 3: Allow Guest → Internet · TCP 443. From matches, but To is Internet and the phone wants the records server. No match: every condition has to fit.
- No rules left. The default rule applies.
- Result: denied by the default rule, after checking rules 1 to 3.
Change one fact. The same phone now opens a website: Guest → Internet · TCP 443. Rules 1 and 2 still fail on From, but rule 3 fits in every condition, so the connection is allowed by rule 3 and the firewall stops checking. One field, the destination, decided the outcome.
Stage: Experiment
Try it: the school firewall
Here are the same three rules, with five connections checked against them. Find the visitor’s connection to the records system, then test some connections of your own.
Staff, guest and server networks are separated. Each connection is compared with the rules from the top; the first match decides, and anything left over is denied.
| Rule | Action | From | To | Service |
|---|---|---|---|---|
| 1 | Allow | Staff | Records server | TCP 443 |
| 2 | Allow | Staff | Internet | TCP 443 |
| 3 | Allow | Guest | Internet | TCP 443 |
| Default | Deny | Anything that matched no rule above | ||
Change the order of the rules
A teacher opens the records system
Staff → Records server · TCP 443
Allowed by rule 1, after checking rule 1.
A teacher visits a website
Staff → Internet · TCP 443
Allowed by rule 2, after checking rules 1 and 2.
A visitor’s phone tries the records system
Guest → Records server · TCP 443
Denied by the default rule: none of rules 1 to 3 matched.
A visitor’s phone visits a website
Guest → Internet · TCP 443
Allowed by rule 3, after checking rules 1 to 3.
A teacher tries Remote Desktop to the records server
Staff → Records server · TCP 3389
Denied by the default rule: none of rules 1 to 3 matched.
Test a connection of your own
A real policy would also need rules for services such as DNS. This one is cut down to show the method; the panel models only first match and default deny.
Notice that nothing had to say “deny guests access to the records server”. The default rule did that, because no rule allowed it. The same default blocked Remote Desktop, even for staff, because that service was never needed.
Stage: Experiment
Why rule order matters
Think it through
Show the answer
Answer: B. No: rule 1 matches guests first, so rule 2 is never reached.
Rule 1 matches every guest connection, so rule 2 never applies. In the panel, move rule 2 above rule 1 and watch the visitor’s connection change.
The same school, after someone added a broad guest rule for an event and placed it at the top.
| Rule | Action | From | To | Service |
|---|---|---|---|---|
| 1 | Allow | Guest | Any | Any |
| 2 | Deny | Guest | Records server | Any |
| 3 | Allow | Staff | Records server | TCP 443 |
| Default | Deny | Anything that matched no rule above | ||
Change the order of the rules
A visitor’s phone tries the records system
Guest → Records server · TCP 443
Allowed by rule 1, after checking rule 1.
Test a connection of your own
Rule 2 looks as if it protects the records server, but rule 1 matches first. Reading a rule on its own is not enough; its position decides whether it ever applies.
Because checking stops at the first match, a broad rule placed too high can hide a more specific rule below it. The lower rule is then never reached.
Stage: Discover
Stateful filtering: remembering conversations
A connection involves traffic in both directions. When a teacher’s PC requests a web page, the web server’s replies must be allowed back in, yet nobody wants a rule allowing any internet traffic in to staff PCs.
Think it through
Show the answer
Answer: A. The firewall remembers the request and lets its reply in.
A firewall that remembers the conversations it has allowed out can let their replies in, and nothing else.
A stateless filter judges every packet on its own, so it needs rules for both directions. A stateful firewall remembers the connections it has allowed out, and lets matching replies back in automatically.
A fictional teacher's PC at 10.10.0.25 visits a web server at 203.0.113.80, through a stateful firewall using the school’s rules. NAT, if used, is left out to keep the example simple.
- Step 1: Teacher’s PC 10.10.0.25 to Web server 203.0.113.80. Opens a TCP connection to port 443Rule 2 allows it. The firewall records the connection: 10.10.0.25:51000 ↔ 203.0.113.80:443.
- Step 2: Web server 203.0.113.80 to Teacher’s PC 10.10.0.25. Replies to 10.10.0.25:51000No rule allows traffic in from the internet, but this reply matches the recorded connection, so it is allowed.
- Step 3: Teacher’s PC 10.10.0.25 to Web server 203.0.113.80. Sends the HTTPS requestStill part of the same recorded connection.
- Step 4: Web server 203.0.113.80 to Teacher’s PC 10.10.0.25. Sends a new, unrequested connection attemptIt matches no recorded connection and no rule, so the default rule denies it.
The record is removed when the connection closes or has been idle for a while, so the way back in does not stay open.
Stage: Explain
Firewalls and NAT are different jobs
A home router often performs NAT and firewall filtering in the same box, which makes them easy to confuse. They are different controls:
- NAT changes addresses so that private devices can share a public address. See IP forwarding, default gateways and NAT/PAT.
- A firewall policy decides which traffic is allowed.
NAT can make it harder for unrequested inbound traffic to reach an internal device, because there may be no mapping for it. That is a side effect, not a policy. NAT commonly translates outbound traffic too, but translating addresses does not decide which outbound connections are permitted; that needs a policy. NAT behaviour can also be changed by port-forwarding settings, and does not apply where no translation happens, as is usual with IPv6.
Check your understanding
Show the answer
Answer: B. Disagree: NAT changes addresses; a policy decides what is allowed.
NAT translates addresses. Any blocking it causes is a side effect, which a port-forwarding setting can undo, and it does nothing about outbound traffic. A firewall policy is what decides.
Stage: Discover
Segmentation: giving the firewall a boundary to guard
A flat network, where every device can reach every other, gives a firewall nothing to guard inside it. Segmentation divides the network into zones and routes traffic between them through a point where a policy is enforced.
Switch Ports, VLANs and 802.1Q Trunks showed the first half of this: VLANs separate groups of devices, and moving between VLANs needs a router or a Layer 3 switch (a switch that can also route). Segmentation adds the second half: at that routing point, a firewall decides which crossings are allowed. As that lesson put it, VLANs separate; routing reconnects. The firewall decides what is allowed to reconnect.
In this example each zone is one VLAN and one IP subnet, and the network firewall sits between them. Traffic between zones passes that firewall; traffic between two devices in the same zone normally does not.
Enforcement pointRouter with firewall policy, applying the school’s rules from this lesson
Staff zone
VLAN 10 · 10.10.0.0/24
Teachers’ PCs and laptops.
Policy allows it to reachThe records server on TCP 443, and websites on the internet.
Guest zone
VLAN 20 · 10.20.0.0/24
Visitors’ phones and laptops.
Policy allows it to reachWebsites on the internet only.
Server zone
VLAN 30 · 10.30.0.0/24
The records server.
Policy allows it to reachNothing: no rule allows connections out of this zone. Staff may connect in, on TCP 443 only.
Internet
Outside the school
Everything beyond the school’s connection.
Policy allows it to reachNothing inside, except replies to connections that were started from inside.
Two teachers’ laptops in the staff zone are in the same VLAN and subnet, so they normally communicate through the local switches without crossing this network firewall. Here, their host firewalls are what can filter that traffic. Other designs differ: a zone can span several subnets with filtering between them, or be divided further.
What segmentation achieves
- It limits the spread of an attack. The Attack Chain showed an attacker exploring the network after gaining a foothold. If a guest device is compromised, segmentation stops it reaching the records server at all.
- It protects the most sensitive systems. The server zone accepts only the few connections it needs.
- It shrinks local attack surfaces. Broadcasts, and the flooding described in MAC Flooding and Port Security, stay inside one VLAN.
Segmentation is enforcement, not labelling. Putting systems in separate VLANs achieves little if the router between them allows every crossing.
Check your understanding
Show the answer
Answer: C. No: the router reconnects every zone, so nothing is enforced.
VLANs separate; routing reconnects; the policy decides what may reconnect. With “allow everything”, nothing is enforced, so there is no segmentation in the sense that matters.
Stage: Explain
What a firewall cannot do
- Allowed traffic can still be harmful. A phishing link opened over HTTPS uses the same allowed port as legitimate browsing. The firewall saw permitted traffic, which is why it is one layer in Defence in Depth, not the whole defence.
- It cannot see inside encryption. A traditional firewall reads addresses and ports. The content of an HTTPS connection is hidden from it.
- It only sees traffic that passes through it. In a design like the school’s, where a zone is a single VLAN and subnet, traffic between devices in that zone is switched locally and does not cross the network firewall. Traffic on any route that bypasses the firewall is not checked either. Where filtering is needed inside a zone, it has to come from somewhere else, such as host firewalls or a design that places another enforcement point there.
- It is only as good as the configuration actually running. A router’s console may, for example, show firewall
configure failed!messages at start-up; until their cause is established, no conclusion can be drawn about what that router is filtering. The configuration a device is actually running, not the one someone intended, decides what it does, and it is worth checking.
Other controls look further into traffic than addresses and ports. A web application firewall filters requests to one web application; the DDoS lesson discusses where it helps and where it does not. Intrusion detection and prevention systems examine traffic for signs of attack, and either raise an alert or block it. They are named here so the gaps in a simple firewall are clear.
Firewall policies tend to grow and decay: a temporary rule for an event stays for years, and nobody remembers why a broad rule exists. Good practice is to give each rule a recorded purpose and owner, log what the default rule denies, and review the rule list regularly, removing anything no longer needed and checking the order.
Stage: Apply
Apply it in a new situation
These questions use the lesson in situations it has not shown. For the strongest test of your understanding, come back to them on another day and answer each one at the first attempt.
Apply it
- Hint 1: Check each rule’s From and To before its service.
Show the answer
Answer: A. Denied by the default rule, because neither rule matches it.
Neither rule matches: rule 1 goes only to the internet, and rule 2 is only for staff. The default rule denies it.
Apply it
- Hint 1: Look at what a traditional firewall can and cannot read.
Show the answer
Answer: B. Allows it: it is ordinary HTTPS traffic to a website.
The connection is allowed traffic: a website on TCP 443. A firewall is one layer; training, filtering and multi-factor authentication have to deal with the phishing itself.
Stage: Check
Check your understanding
These questions come from the approved revision bank. Choose an answer and check it; the explanation and its sources follow.
Show answer
Answer: False
False. NAT changes addressing; firewall policy controls permitted traffic. Translation is not a substitute for a firewall, even though both functions often exist on the same home router.
Revision sources: Session 5: Networking Fundamentals — Part 1 (Classroom session record)
Show answer
Answer: It is allowed by rule 1, because the first matching rule decides and rule 2 is never reached.
Rules are checked from the top and the first rule whose conditions all match decides. Rule 1 allows traffic from any source to the patient-records system on TCP 443, which includes the guest phone, so checking stops there and rule 2 never applies to this traffic. Deny rules have no automatic priority; their position decides whether they are reached. Moving rule 2 above rule 1, or narrowing rule 1 to staff, would fix the policy. Rule 3 concerns internet traffic, not the records system.
Revision sources: Firewalls, Traffic Filtering and Segmentation (Supplementary Study Guide explanation)
Show answer
Answer: A staff laptop opening a website on the internet over TCP 443.; A staff laptop connecting to the file server over TCP 445.
Only traffic matching an allow rule passes and everything else meets the default deny. A matches rule 2 and D matches rule 1. B asks for a service no rule allows, C comes from a guest device that no rule mentions and E uses TCP 80, which rule 2 does not include. Nothing had to say “deny guests”: the default rule did that.
Revision sources: Firewalls, Traffic Filtering and Segmentation (Supplementary Study Guide explanation)
Show answer
Answer: Allows the reply, which matches the recorded connection, and denies the new attempt.
A stateful firewall records the connections it has allowed and lets their replies back in without a separate rule. The reply belongs to the connection the PC opened, so it is allowed. The new attempt is not part of any recorded connection and no rule allows inbound traffic, so the default denies it. A stateless filter, which judges each packet on its own, would need an inbound rule for the replies.
Revision sources: Firewalls, Traffic Filtering and Segmentation (Supplementary Study Guide explanation)
Show answer
Answer: Host firewalls on the laptops, since traffic inside one VLAN and subnet stays off the network firewall.
Segmentation controls which traffic crosses between zones, and where each zone is one VLAN and subnet, traffic inside a zone is switched locally without crossing the network firewall. Filtering there has to come from somewhere else, such as host firewalls. The laptops share a VLAN, so VLAN membership does not separate them. Enabling and correctly configuring firewalls is a basic device-security practice, which is what a host firewall provides.
Revision sources: Session 2: Cyber Fundamentals Part 2 (Classroom session record) · Firewalls, Traffic Filtering and Segmentation (Supplementary Study Guide explanation)
Study and revision
Practise through the Security Architecture topic and the Networking & Protocols topic. Questions cover first-match rule order, default deny, stateful replies and traffic inside a segmented zone, and a flashcard compares stateful and stateless filtering. They use this lesson’s supplementary explanation, which their explanations name, and fictional networks. They are learning-only.
Stage: Consolidate
What to remember
- A firewall decides which traffic may pass, but only traffic that passes through it.
- Rules are read from the top; the first match decides; anything left over meets the default rule, which should be deny.
- Order matters: a broad rule placed high can hide every rule below it.
- A stateful firewall lets replies in without letting strangers in. NAT is not a firewall.
- Segmentation is zones plus a policy where they meet; VLANs alone are not enough.
- Allowed traffic can still be harmful. A firewall is one layer of defence.
Common misunderstandings
NAT changes addresses. Only a firewall policy decides which traffic is allowed.
It stops traffic its rules do not allow. An attack that uses allowed traffic, such as a phishing link over HTTPS, passes straight through.
Checking stops at the first matching rule. A rule below a broader one may never be reached.
VLANs separate traffic, but a router can reconnect them. Segmentation needs a policy that restricts which traffic may cross.
Lesson sources and acknowledgements
Sources and scope
- Taught in Session 2 (see the Session 2 Learning Log): enabling and correctly configuring firewalls as a basic device-security practice.
- Taught in Sessions 3 and 4 (see Session 3 and Session 4): firewalls as one of the five technical control areas of Cyber Essentials.
- Taught in Session 5 (see the Session 5 Learning Log): NAT is not a firewall and is not a substitute for one.
- From the Study Buddy session on 23 September (see the entry): the firewall
configure failed!messages observed on the lab VyOS router, whose cause was not established. The session was supplementary to the course, not a numbered classroom session. - Supplementary explanation: everything about how firewalls work, including host and network firewalls, the fields a firewall checks, rule evaluation, default deny, rule order, stateful filtering, segmentation and zones, the limitations, the note on other controls, the practical note and the misunderstandings. These go beyond what was taught and are included to explain the classroom points.
- Guided version (published 1 November 2026, awaiting the site owner’s editorial review): the reception-desk opening and its two questions, every question asked in the lesson with its feedback and hints, the library and phishing examples, the interactive rule panels and the closing summary are supplementary explanation written for the Study Guide. The settings are fictional. The questions in the lesson’s steps are not revision-bank items; those in “Check your understanding” are, unchanged.
- No practical work is claimed. The school, its networks and its rules are fictional. I have not configured a firewall or segmented a network.
Every point where an attacker could interact with, or try to get into, an organisation, system or application.
Communication sent to every device in the relevant broadcast domain. Routers do not normally forward ordinary local broadcasts.
A measure intended to modify risk, for example by restricting access, detecting misuse or supporting recovery.
A UK certification scheme covering five technical control areas and based on verified self-assessment. Cyber Essentials Plus adds technical verification.
A policy under which any traffic not explicitly allowed by a rule is blocked.
Transforming data with a cipher and a key so that it cannot be read without the right key. Decryption reverses it.
A control that allows or blocks network traffic according to configured rules.
An entry in a firewall policy that combines conditions, such as source, destination, protocol and port, with an action: allow or deny.
An endpoint that sends or receives data on a network. Hosts are nodes, but not every node is an end host.
HTTP protected by TLS. HTTP/1.1 and HTTP/2 commonly use TCP port 443, while HTTP/3 uses QUIC over UDP port 443.
A logical network-layer address identifying an interface for delivery across networks. IPv4 addresses are 32 bits; IPv6 addresses are 128 bits.
Authentication that requires two or more different types of factor, such as something you know and something you have.
Translating IP addresses as traffic passes a device, commonly so that devices with private addresses can use a public-facing address.
The unit of data at the Network layer, such as an IP packet. It carries source and destination IP addresses between networks.
A deceptive message designed to trick the recipient into an action, such as revealing sign-in details or opening a malicious link.
A document that sets organisational rules and expectations, defining what is and is not permitted.
A 16-bit logical number that identifies a service or endpoint for TCP or UDP. It is different from a physical switch port.
An agreed set of rules for how data is formatted, transmitted and interpreted so that devices can communicate.
A device that forwards traffic between networks, for example between a private local network and the internet.
Dividing an environment into parts, with enforced rules about which communication is allowed between them.
A firewall that keeps track of the connections it has allowed, so replies belonging to them are let through without a separate rule.
One network within a larger set of networks: a group of IP addresses that share the same network part, so that devices in it can reach each other directly without a router.
A device that connects devices within a local network and forwards Ethernet frames using the MAC addresses it has learned.
A connection-oriented transport protocol that starts connections with a SYN, SYN-ACK, ACK handshake and provides reliable, ordered delivery.
A control implemented or enforced by technology, such as multi-factor authentication, encryption or a firewall.
A connectionless transport protocol that sends datagrams without first establishing a connection or guaranteeing delivery.
A separate network created inside a switch, or a group of linked switches, by assigning each port to a numbered group. Devices in the same VLAN reach each other directly; devices in different VLANs can communicate only through a router.
A control that filters requests to a web application using rules about the application-layer content of those requests.
Your progress on this lesson
Saved in this browser only. It is not sent anywhere, does not follow you to another device, and is lost if you clear this site’s data.
This browser is not allowing the site to save progress, so it will be forgotten when you leave the page.