Firewalls, Traffic Filtering and Segmentation

Lesson plan

Level

Intermediate

Time

About 70 minutes; the steps below add up to 69

Learners work out the two rules that make a firewall policy work from a school reception desk: refuse anyone the list does not mention (default deny), and act on the first line that fits (first match). The firewall panels then let them see both, move rules to watch the outcome change, and test connections of their own, before stateful filtering, NAT, segmentation and the limits of a firewall are added one at a time.

Objectives

• Explain what a firewall checks and where host and network firewalls sit
• Work out how a rule list decides a connection: first match wins, then default deny
• Explain why rule order matters, and find a rule that can never take effect
• Explain how a stateful firewall lets replies in without letting strangers in, and why NAT is not a firewall
• Explain how segmentation gives a firewall a boundary to guard, and what a firewall cannot do

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Try both rule panels before the lesson: move a rule, test a connection, then reset them from this page.
• Learners need ports, NAT and VLANs from earlier lessons. A one-line reminder of each is enough if some have not done them.
• The lesson takes about 69 minutes. To teach it in two parts, stop after “Why rule order matters”; the second part opens with “Stateful filtering: remembering conversations”.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Explain what a firewall checks and where host and network firewalls sit
   • Work out how a rule list decides a connection: first match wins, then default deny
   • Explain why rule order matters, and find a rule that can never take effect
   • Explain how a stateful firewall lets replies in without letting strangers in, and why NAT is not a firewall
   • Explain how segmentation gives a firewall a boundary to guard, and what a firewall cannot do

   Purpose: Learners work out the two rules that make a firewall policy work from a school reception desk: refuse anyone the list does not mention (default deny), and act on the first line that fits (first match). The firewall panels then let them see both, move rules to watch the outcome change, and test connections of their own, before stateful filtering, NAT, segmentation and the limits of a firewall are added one at a time.

2. 1. The reception desk Think 6 min

   Purpose: Discover default deny and first match from a familiar list of who may go where, before any firewall term.

   Ask

   • The driver is on neither line. What should reception do?
   • A new first line lets visitors go anywhere. Where can a parent who signs in as a visitor go now?

   Responses to expect

   • Most say turn the driver away; ask why a list of everyone to keep out would never work.
   • The second question often draws “only the hall”; read the list aloud from the top and stop at the first line that fits.
   • On screen in turns: the opening question, its answer; then the question on a new first line, and its answer; a firewall works the same way.

   Misconceptions to challenge

   • A learner may believe: “If nothing forbids it, it is allowed.” Respond: Then the list would need to name everyone to keep out. A safe list names who is allowed.

   Discussion pause: Let learners argue the parent question before revealing.

   In the lesson window

   • Think it through: A delivery driver arrives and asks to go to the staff room. They are not on either line of the list. What should reception do, and why?
   • Think it through: Someone adds a new first line: “Visitors may go to any room.” Line 2 still says parents may go only to the hall. A parent signs in as a visitor. Where can they go now?

3. 2. Why firewalls keep coming up Explain 2 min

   Purpose: Connect firewalls to points learners have met: device security, Cyber Essentials, and NAT not being a firewall.

   Ask

   • Where have firewalls come up before?

   Responses to expect

   • Cyber Essentials and device security are the usual answers.
   • On screen in turns: the opening; then three angles, starting with device security; baseline schemes; networking; from why to how.

4. 3. Where firewalls sit Explain 5 min

   Purpose: Distinguish host and network firewalls, and establish that a firewall only judges traffic that passes through it.

   Ask

   • Can the firewall at the internet edge stop one guest laptop attacking another on the same Wi-Fi?

   Responses to expect

   • Many say yes; ask them to trace the path the traffic takes.
   • On screen in turns: the opening; then two placements, starting with the host firewall; the network firewall; the check question on two laptops on the same Wi-Fi, and its answer; the two work together.

   Misconceptions to challenge

   • A learner may believe: “The network firewall protects everything on the network.” Respond: Only traffic that crosses it. Traffic inside one network needs host firewalls.

   In the lesson window

   • Check your understanding: Two laptops are on the same guest Wi-Fi network, and one of them is infected. Can the network firewall where the school meets the internet stop the infected laptop connecting to the other?

5. 4. What a firewall checks Explain 4 min

   Purpose: List the header fields a traditional firewall can check, and link rules to least privilege.

   Ask

   • Which of these can a firewall read: the port, the address, or the words in an encrypted message?

   Responses to expect

   • Port and address. The encrypted content is a preview of the limits step.
   • On screen in turns: the opening; then what a firewall can check, starting with addresses; the protocol; the port numbers; direction and interface; a firewall rule.

6. 5. First match wins, then default deny Predict 6 min

   Purpose: Apply first match and default deny to one connection, rule by rule.

   Ask

   • is the visitor’s phone allowed to the records system?

   Responses to expect

   • Learners quickly see the default rule decide; the walkthrough confirms it rule by rule.
   • On screen in turns: the opening; then the question on a guest and the records server, and its answer; following one connection through the rules, starting with rule 1; rule 2; rule 3; no rules left; the result; changing one fact.

   Misconceptions to challenge

   • A learner may believe: “Every rule in the list is applied.” Respond: Checking stops at the first match. Rules below may never be reached.

   If the explanation does not land: Return to the reception desk: the list is read from the top, and anyone not on it is turned away.

   In the lesson window

   • Think it through: The school’s firewall has three rules: staff may reach the records server on TCP 443, staff may reach the internet on TCP 443, and guests may reach the internet on TCP 443. No rule mentions guests and the records server. What happens when a visitor’s phone tries to open the records system?

7. 6. Try it: the school firewall Experiment 6 min

   Purpose: Let learners test connections of their own against the school’s rules.

   Ask

   • Test a connection of your own: a guest using Remote Desktop to the records server. What decides it?

   Responses to expect

   • Panel: the panel is on screen when the step opens, so the instructor view’s jump to this step lands on it. Find the visitor’s connection, then test a guest using Remote Desktop to the records server.
   • On screen in turns: the opening; then nothing had to deny guests.

   Discussion pause: Ask pairs to write one rule that would let staff use Remote Desktop to the records server, and where in the list it should go.

   In the lesson window

   • Firewall rules

8. 7. Why rule order matters Experiment 6 min

   Purpose: Experience rule order by moving a rule in the panel.

   Ask

   • In the panel, move rule 2 above rule 1. What changes, and why?

   Responses to expect

   • Moving the deny above the broad allow flips the visitor’s connection to denied. The panel is on screen when the step opens, so the instructor view’s jump lands on it.
   • On screen in turns: the opening question, its answer; then a broad rule hides the rules below it.

   Misconceptions to challenge

   • A learner may believe: “A deny rule always wins.” Respond: Position decides, not the action. An allow above it wins first.

   If the explanation does not land: Return to the reception desk: the visitor line at the top is rule 1 in this panel.

   In the lesson window

   • Think it through: Someone adds a broad guest rule for an event and puts it at the top. Rule 2, below it, denies guests the records server. Is the records server protected from guests?
   • Firewall rules

9. 8. Stateful filtering: remembering conversations Discover 7 min

   Purpose: Show how a stateful firewall lets replies in without a rule that lets strangers in.

   Ask

   • No rule allows anything in from the internet. How does the web page get back to the teacher?

   Responses to expect

   • Some suggest a rule allowing internet traffic in; ask who else that would let in.
   • On screen in turns: the opening; then the question on replies coming back, and its answer; stateless and stateful filters; a stateful firewall, starting with the teacher’s request; the server’s reply; the HTTPS request; an unrequested attempt.

   Discussion pause: Reveal the exchange one message at a time; before the last, ask what the firewall will do with a connection nobody asked for.

   In the lesson window

   • Think it through: The school's rules allow staff to visit websites, and no rule allows anything in from the internet. A teacher opens a web page. How can the website’s reply get back in?

10. 9. Firewalls and NAT are different jobs Explain 4 min

    Purpose: Separate NAT from a firewall policy.

    Ask

    • The router does NAT. Is that a firewall?

    Responses to expect

    • Expect “yes, it blocks incoming traffic”; explain that this is a side effect, which port forwarding can undo.
    • On screen in turns: the opening; then NAT’s side effect is not a policy; the check question on whether NAT is enough, and its answer.

    Misconceptions to challenge

    • A learner may believe: “NAT means I already have a firewall.” Respond: NAT changes addresses. Only a policy decides what is allowed, in either direction.

    In the lesson window

    • Check your understanding: A small office’s router performs NAT. The manager says: “We don’t need a firewall policy; NAT already blocks everything coming in.” What is the best response?

11. 10. Segmentation: giving the firewall a boundary to guard Discover 8 min

    Purpose: Show segmentation as zones plus a policy where they meet.

    Ask

    • Three VLANs and a router that allows everything: segmented or not?
    • If a guest phone is infected, what can it reach in this school?

    Responses to expect

    • The VLAN question splits the room; settle it with “VLANs separate; routing reconnects; the policy decides”.
    • Diagram: the policy for each zone is held back; ask what each zone should be allowed to reach before revealing it.
    • On screen in turns: the opening; then VLANs: the first half of segmentation; the school’s zones, with the policy held back; what the policy lets each zone reach; what segmentation achieves, starting with limiting spread; protecting sensitive systems; shrinking local attack surfaces; segmentation is enforcement, not labelling; the check question on VLANs with an allow-all rule, and its answer.

    In the lesson window

    • Check your understanding: A school puts staff, guests and servers in three separate VLANs. The router between them has one rule: allow everything. Is the network segmented?

12. 11. What a firewall cannot do Explain 4 min

    Purpose: Set out the limits, so a firewall is seen as one layer.

    Ask

    • A phishing link over HTTPS: what does the firewall see?

    Responses to expect

    • Ordinary allowed web traffic.
    • On screen in turns: the opening; then four limits, starting with harmful allowed traffic; encryption; traffic that never passes; the configuration actually running; other traffic controls; policies grow and decay.

13. 12. Apply it in a new situation Apply 4 min

    Purpose: Set up independent application, ideally on a later day.

    Ask

    • Who will try these now, and who later in the week?

    Responses to expect

    • The library question tests reading From and To before Service.
    • On screen in turns: the opening; then the question on the library’s rules, and its answer; the question on a phishing link that passes, and its answer.

    In the lesson window

    • Apply it: A library’s firewall has two rules, in this order: 1. Allow Public Wi-Fi → Internet, any service. 2. Allow Staff → Catalogue server, TCP 443. Then default deny. A member of the public tries to reach the catalogue server on TCP 443. What happens?
    • Apply it: A firewall allows staff to visit websites on TCP 443 and blocks everything else. A member of staff clicks a phishing link to a fake sign-in page over HTTPS. What does the firewall do?

14. 13. Check your understanding Check 4 min

    Purpose: Check the lesson against the approved revision-bank questions.

    Ask

    • Answer individually, then compare before revealing.

    Responses to expect

    • The shadowed-deny question rewards anyone who moved the rules in the panel.
    • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; where to practise next.

15. 14. What to remember Consolidate 3 min

    Purpose: Summarise the six points and the common misunderstandings.

    Ask

    • Without looking: what happens to traffic that matches no rule?

    Responses to expect

    • It meets the default rule, which should be deny.
    • On screen in turns: the opening; then the summary; the common misunderstandings.

16. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • A firewall decides which traffic may pass, but only traffic that passes through it.
    • Rules are read from the top; the first match decides; anything left over is denied by default.
    • Order matters: a broad rule placed high hides the rules below it.
    • A stateful firewall lets replies in without letting strangers in; NAT is not a firewall.
    • Segmentation needs a policy where the zones meet. Allowed traffic can still be harmful.

Consolidation

• A firewall decides which traffic may pass, but only traffic that passes through it.
• Rules are read from the top; the first match decides; anything left over is denied by default.
• Order matters: a broad rule placed high hides the rules below it.
• A stateful firewall lets replies in without letting strangers in; NAT is not a firewall.
• Segmentation needs a policy where the zones meet. Allowed traffic can still be harmful.