MODULE 4: Network Security
Lesson 1: Firewalls (Types + Rules)
What is a Firewall?
A firewall is a security device/software that controls incoming and outgoing network traffic based on rules.
It works like a security guard:
“Should this traffic be allowed or blocked?”
Types of Firewalls
- Packet Filtering Firewall
- Oldest, simplest type
- Checks source IP, destination IP, port
- Fast but limited
- Cannot inspect payload or behavior
- Stateful Firewall
- Tracks active connections
- Understands traffic context
- More intelligent than packet filtering
Example:
Allows return traffic for a legitimate connection.
- Next-Generation Firewall (NGFW)
Modern firewalls with advanced features:
- Deep Packet Inspection
- Application Layer Filtering
- IPS integrated
- Anti-malware
- Web filtering
- SSL inspection
Brands:
- Palo Alto
- FortiGate
- Cisco Firepower
- Sophos XG
- Web Application Firewall (WAF)
Protects websites and web apps from:
- SQL Injection
- XSS
- CSRF
- File upload attacks
Common providers:
Cloudflare, AWS WAF, F5, Imperva
Firewall Rules
Rules determine what traffic is allowed or denied:
- Source IP
- Destination IP
- Port (80, 443, 22, etc.)
- Protocol (TCP/UDP)
- Application (Facebook, YouTube, SSH, SQL Server)
Example rule:
Allow internal LAN → access to server on port 443
Block unknown external traffic → corporate network
Best Practices
- Deny all → allow only necessary traffic
- Review rules regularly
- Document rule changes
- Log all traffic for auditing
- Use segmentation (separate VLANs/networks)
Lesson 2: IDS vs IPS (Intrusion Detection & Prevention Systems)
1. What is IDS?
Intrusion Detection System
Monitors traffic and detects suspicious activity but does NOT block, only alerts.
Analogy: A CCTV camera.
Types:
- Network IDS (NIDS) → monitor’s traffic
- Host IDS (HIDS) → monitors system logs/files
2. What is IPS?
Intrusion Prevention System
Monitors and automatically blocks malicious traffic.
Analogy: A security guard that stops attackers.
IPS can:
- Drop packets
- Block IP addresses
- Reset connections
- Update signatures automatically
IDS vs IPS (Difference Table)
| Feature | IDS | IPS |
| Detect attacks | ✔ | ✔ |
| Block attacks | ✖ | ✔ |
| Position | Out-of-path | In-line |
| Reaction speed | Slower | Real-time |
Common Tools
- Snort
- Suricata
- Cisco Firepower
- Palo Alto Threat Prevention
- FortiGate IPS
What IPS Can Stop
- SQL injection attempts
- Brute force attacks
- Port scanning
- Worms & botnets
- Known malware signatures
Lesson 3: Secure Network Design (DMZ, VLANs, Subnetting)
1. Network Segmentation
Separating network into smaller secure zones.
Benefits:
- Limits lateral movement
- Reduces attack impact
- Improves traffic performance
- Better monitoring
2. DMZ (Demilitarized Zone)
A semi-secure network area hosting public-facing service:
- Websites
- Email servers
- DNS servers
- VPN gateways
Traffic from internet → goes to DMZ first.
Internal LAN remains protected.
3. VLANs (Virtual Local Area Networks)
Logical separation of networks in the same switch.
Example VLAN structure:
- VLAN 10 → HR
- VLAN 20 → Finance
- VLAN 30 → IT
- VLAN 40 → Guests
- VLAN 50 → IP Cameras
This prevents one department from interfering with another.
4. Subnetting
Breaking networks into smaller parts:
- Reduces broadcast traffic
- Improves security
- Helps IP management
Example:
From 192.168.1.0/24 →
Divide into 192.168.1.0/26, 1.64/26, 1.128/26…
5. Zero Trust Networking
“Never trust, always verify.”
- No implicit trust for internal devices
- Every request must be authenticated
- MFA enforced everywhere
- Micro-segmentation
Lesson 4: VPNs & Encryption
1. What is a VPN?
VPN = Virtual Private Network
Encrypts traffic between user and company network.
Used for:
- Remote work
- Secure communication
- Accessing internal resources
Types of VPN
- Site-to-Site VPN
Connects two offices securely via internet.
Example:
Kenera Addis HQ ↔ Kenera Bishoftu branch.
- Remote Access VPN
Allows employees to connect from home or field using:
- OpenVPN
- Cisco AnyConnect
- FortiClient
- L2TP/IPSec
2. Encryption
Why encryption?
Prevents attackers from reading data even if intercepted.
Types of Encryptions:
- Symmetric (AES, same key for encrypt/decrypt)
- Asymmetric (RSA, public/private keys)
- Hashing (SHA-256, one-way)
HTTPS (TLS/SSL Encryption)
Protects web traffic from MITM attacks.
Locks icon in browser = encrypted communication.
Lesson 5: Network Monitoring Tools (SolarWinds, PRTG, LibreNMS)
Network monitoring tools detect problems, attacks, performance issues, and system failures.
They show:
- Devices online/offline
- Traffic usage
- Bandwidth consumption
- CPU, RAM, Disk
- Link failure
- Suspicious activity
Top Monitoring Tools
- SolarWinds NPM
- Enterprise-grade
- Traffic analysis
- Device discovery
- Alerting
- Mapping
- SNMP-based monitoring
Used in banks, telecom, large companies.
- PRTG Network Monitor
- Easy to use
- Sensors for CPU, RAM, Ping, HTTP, bandwidth
- Custom dashboards
- Email alerts
Great for medium-sized networks.
- LibreNMS (Open-Source)
- Free
- Auto-discovery
- SNMP monitoring
- Graphs & alerts
- Community-driven
Used by cost-conscious organizations.
Why Monitoring Matters
- Detect network outages quickly
- Find devices using too much bandwidth
- Detect unusual traffic (possible attack)
- Monitor health of switches, routers, servers
- Improve performance planning
Example Alerts
- “High CPU usage on Router 1”
- “Firewall interface down”
- “Unusual outbound traffic detected”
- “Server disk usage above 90%”
This helps IT teams act before failure occurs.
Module 4 Summary
Students now understand:
- How firewalls protect networks and the different types
- Why IDS & IPS are critical for detecting/preventing attacks
- Secure network design using DMZ, VLANs, subnetting
- How VPNs and encryption protect communication
- How monitoring tools help detect issues and attacks
This module answers the question:
“How do we secure and monitor enterprise networks?”