Stopping one laptop from reaching the tills
Network segmentation means splitting one network into separate zones, and letting traffic pass between zones only by rules. A problem in one zone then cannot spread freely to the others.
It limits the damage when something goes wrong.
Picture a shop where the tills, the staff laptops and the guest wifi all share one flat network. One infected guest phone could now try every till.
By the end of this lesson
Note
I can keep parts of a network apart.
Key words
| Word | What it means |
|---|---|
| Segmentation | splitting a network into zones with rules between them |
| Zone | a group of machines with the same level of trust |
| Lateral movement | an attacker moving from one machine to its neighbours |
| DMZ | a zone for public servers, kept apart from the inside |
| Inter-zone rule | a firewall rule for traffic that crosses from one zone to another |
| Flat network | one network where every machine can reach every other |
The cells students fill in are left blank in this preview.
A flat network lets a problem spread
On a flat network, every machine can reach every other. That is simple, and it is risky.
Suppose an attacker takes over one laptop. They can now probe every other machine from the inside. This is lateral movement, and a flat network makes it easy.
Segmentation puts walls inside the network, so the attacker finds a closed door at each step.
Worked example: who may reach whom
| From \ To | Guest | Staff | Till | DMZ |
|---|---|---|---|---|
| Guest | Yes | No | No | Yes, web only |
| Staff | No | Yes | Yes, till app only | Yes |
| Till | No | No | Yes | No |
| DMZ | No | No | No | Yes |
The cells students fill in are left blank in this preview.
A VLAN builds zones, a router joins them
A VLAN is one way to build zones on a shared switch. Each zone gets its own VLAN, so the switch keeps their traffic apart.
To let a zone talk to another, a router joins them. That router is the one place where traffic crosses, so it is the right place for the inter-zone rules.
The wall is the router with its rules. The VLAN only builds the rooms.
Meet the switch, the router and the hosts
vlanlab statusShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Read the switch's VLAN table
sudo ip netns exec sw bridge vlan showShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Can h10 connect to the server?
sudo ip netns exec h10 nc -z -w 2 10.10.0.100 8080 && echo reachableShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Can h20 connect to the server?
sudo ip netns exec h20 nc -z -w 2 10.10.0.100 8080 2>/dev/null || echo blockedShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Apart by accident is not apart by design
The server srv listens on ports 80 and 8080. The Run from h10 prints reachable, because h10 and srv are on the same address range.
The Run from h20 prints blocked. But the reason is not a rule. The switch has not separated anyone: every port is still in VLAN 1. h20 simply has no gateway to send its packet to.
That is separation by accident. Once the router exists, the separation must come from a rule you wrote.
Choose zones by trust and allow little
Group machines by how much you trust them and what they do. Guests, staff, payment machines and public servers each get a zone.
Then fill in the who-reaches-whom table. Start with no in every box. Change a box to yes only when a real job needs it, and then only for the ports that job uses.
A DMZ holds the servers the public must reach. If one is broken into, the attacker is still outside the staff and till zones.
A common mistake
Warning
Many people think putting machines in different VLANs makes them secure. A VLAN only keeps broadcast traffic apart. The router that joins the VLANs needs rules too, or every zone can still reach every other zone.
Going further: draw your own matrix
Your college has a library zone, a lab zone, a staff zone and a zone for the web servers. Draw the table of who may reach whom.
Start with no in every box. Then allow only what a real job needs, and write the job beside each yes.