The guest and the payroll server
A visitor joins the guest Wi-Fi to check their email. Without rules, that same visitor can ask the finance server for its web page, or ping a staff desk.
A firewall (a tool that blocks some messages) rule is the lock between rooms. You decide who may pass, and the lock does it every time.
By the end of this lesson
Note
I can write firewall rules so that each group reaches only what it needs, and test them.
Key words
| Word | What it means |
|---|---|
| Firewall | a device or program that blocks some messages and lets others through |
| Rule | one line that says what the firewall does with a kind of message |
| Default deny | block everything unless a rule allows it |
| Segment | one part of a network that is kept apart from the rest |
| Established traffic | replies to a conversation that a permitted device started |
| Network | computers and devices joined together so they can share data |
| Router | a device that passes messages from one network to another |
The cells students fill in are left blank in this preview.
Starter
Have a go
Starter
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
This is practice
Important
The real Task 4a has its own network file and its own device settings screens. Here you use real commands in a lab. Only change the lab. Ask your teacher what the real task lets you configure.
The plan: who may reach what
| From | To | Allowed? | Why |
|---|---|---|---|
| Guest (10.0.50.0/24) | The far network that stands for the internet (10.0.3.0/24) | Yes | Visitors need the internet |
| Guest | Staff desks (10.0.1.0/24) | No | Visitors must not see office devices |
| Guest | The web server (10.0.99.2) | No | The server is for staff only |
| Staff desks | The web server on port 8080 | Yes | Staff need the service |
| Staff desks | The far network | Yes | Staff need the internet |
The cells students fill in are left blank in this preview.
Set up: routes, part one
sudo ip netns exec r1 ip route replace 10.0.3.0/24 via 10.0.12.2; sudo ip netns exec r1 ip route replace 10.0.99.0/24 via 10.0.12.2; sudo ip netns exec r1 ip route replace 10.0.50.0/24 via 10.0.12.2A command for the lesson’s lab terminal. It is shown here and not run.
Set up: routes, part two
sudo ip netns exec r2 ip route replace 10.0.1.0/24 via 10.0.12.1A command for the lesson’s lab terminal. It is shown here and not run.
Set up: the guest node (if not built)
sudo ip netns add guest; sudo ip link add to-guest netns r2 type veth peer name to-r2 netns guest; sudo ip netns exec r2 ip addr add 10.0.50.1/24 dev to-guest; sudo ip netns exec r2 ip link set to-guest up; sudo ip netns exec guest ip addr add 10.0.50.2/24 dev to-r2; sudo ip netns exec guest ip link set to-r2 up; sudo ip netns exec guest ip link set lo up; sudo ip netns exec guest ip route add default via 10.0.50.1A command for the lesson’s lab terminal. It is shown here and not run.