# Network Security and Firewall Configuration

> Chapter 9 of the Courseiva A-PLUS-220-1202 curriculum — https://courseiva.com/learn/a-plus-220-1202/network-security-and-firewall-configuration

**Official objective:** 2.4 — Given a scenario, configure and secure network connections and firewalls.

## Introduction

Network security and firewall configuration. It matters because without a firewall, your computer or network is like a house with the front door wide open — anyone can walk in, including people with bad intentions. For the 220-1202 exam, you need to know how to set up, test, and troubleshoot these digital barriers to protect sensitive data.

## The Building Security Guard Analogy

A building security guard working the front desk of a busy office tower. Their job is not to stop every single person from entering — that would make the building unusable. Instead, they have a list of rules, called an access control list. Employees with a valid ID badge can come and go during business hours. Deliveries from recognised couriers are allowed in through the loading bay, but only after the recipient confirms the drop-off. People who look suspicious or try to enter after midnight without a key card get stopped and questioned.

Now, what happens when the guard gets an alert that someone is trying to break in through a fire escape? They don't just stand there — they run to investigate, block the door, and call the police. That is the intrusion detection and prevention part. A firewall does the exact same thing for your network. It sits at the entrance, checks every piece of data trying to get in or out, and either lets it through based on rules, blocks it, or raises an alarm. The guard never trusts anyone blindly — they verify first. That is the zero-trust model a firewall enforces. Every packet of data is like a person walking up to the desk. The firewall checks its ID, its destination, and its purpose before deciding.

## Core explanation

A firewall is a security device — either hardware or software — that monitors and controls incoming and outgoing network traffic. Think of it as a set of rules that decide what data is allowed to pass and what gets blocked. The core purpose of a firewall is to create a barrier between a trusted internal network (like your company's private office network) and an untrusted external network (like the internet).

Firewalls have been around since the late 1980s. Before firewalls, networks were essentially flat — every device could talk to every other device. That was fine when networks were small and trusted, but as the internet grew, so did the threats. Hackers could directly access any computer. Firewalls introduced the concept of segmentation.

Here is how firewalls work at a high level. Every piece of data sent over a network is broken into packets. Each packet has a header containing the source IP address (where it came from), the destination IP address (where it is going), the port number (which application it is for, like web traffic on port 80 or email on port 25), and the protocol (TCP or UDP). The firewall inspects these headers and compares them against its rule set. If a packet matches a permitted rule, it passes. If it matches a denied rule, it is dropped. If it matches no rule, it is either dropped by default or logged, depending on the firewall's default policy.

There are several types of firewalls you need to know for the exam:

- Packet-filtering firewall: This is the simplest type. It checks only the packet header information and makes a decision based on source/destination IP, port, and protocol. It does not look at the actual data inside the packet. This is fast but not very secure.
- Stateful inspection firewall: This is more advanced. It keeps track of the state of active connections. For example, if you request a web page, the firewall remembers that you initiated the connection and allows the returning traffic. This prevents attackers from sending unsolicited traffic pretending to be a response.
- Proxy firewall (application-level gateway): This acts as an intermediary. The client connects to the proxy, and the proxy connects to the internet on the client's behalf. The two sides never connect directly, which hides the internal network structure. This is more secure but slower because the proxy inspects the application data.
- Next-generation firewall (NGFW): This combines traditional firewall features with intrusion prevention, deep packet inspection (looking at the actual content of the data), and application awareness. It can identify traffic from specific applications like Facebook or Skype and block it even if it runs on a non-standard port.

Configuration is where you set the rules. A default-deny rule is the safest approach: block everything, then only allow what is explicitly needed. For example, if a web server needs to serve web pages, you create a rule that allows inbound traffic to port 80 and 443 from anywhere, but block everything else. You also need to consider outbound rules — what traffic is allowed to leave the network. For instance, you might allow outbound web traffic but block outbound traffic to known malicious IP addresses.

Network segmentation is closely related to firewalls. Instead of having one big flat network, you divide it into smaller subnets, each separated by a firewall. For example, you might have a separate segment for servers, one for employee workstations, and one for guest Wi-Fi. The firewall enforces rules between these segments. A guest on Wi-Fi should not be able to access the server segment.

Virtual LANs (VLANs) are often used with firewalls. A VLAN groups devices together logically, even if they are not physically connected to the same switch. You can then apply firewall rules to the VLAN interfaces to control traffic between them.

Finally, you need to understand the concept of an access control list (ACL). An ACL is simply the list of rules that the firewall uses. Each rule typically has a priority number, and the firewall processes rules in order. The first matching rule is applied. This means rule order is critical. If you accidentally put a broad deny rule before a specific allow rule, the traffic will be blocked. A common exam scenario is troubleshooting why a legitimate service is not working — the answer is often that a firewall rule is missing or misordered.

## Real-world context

An IT professional managing network security for a medium-sized company with 200 employees. The company has an internal network for staff, a guest Wi-Fi network for visitors, and a DMZ (demilitarised zone) for publicly accessible servers like the company website and email server. The IT professional's job is to configure the company's next-generation firewall to protect these three segments.

Step by step, here is what happens in a realistic scenario. First, the IT professional maps out the network. They identify all subnets: 192.168.1.0/24 for staff, 192.168.2.0/24 for guests, and 10.0.0.0/24 for the DMZ. They label the firewall interfaces accordingly — for example, interface Gi0/0 for the internal LAN, Gi0/1 for the DMZ, Gi0/2 for guest Wi-Fi, and Gi0/3 for the internet connection.

Next, they define the security zones. The internal LAN is considered a trusted zone. The DMZ is a semi-trusted zone — it needs to be accessible from the internet but should not be able to initiate connections to the internal LAN. The guest Wi-Fi is untrusted — guests should only have internet access, no access to internal resources.

Then, they create the firewall rules. The key rules might be: allow outbound web traffic (ports 80 and 443) from the internal LAN to anywhere; allow inbound traffic from the internet to the DMZ web server only on ports 80 and 443; block all traffic from the DMZ to the internal LAN (unless specifically required for updates); allow guest Wi-Fi internet access only (block all local access); allow internal LAN access to the DMZ for management purposes (like SSH from a specific admin workstation).

After configuring the rules, the IT professional tests them. They try to access the company website from outside the network, confirm it works. They try to ping the internal server from the guest Wi-Fi — it should fail. They try to initiate an outbound connection from the DMZ to the internal LAN — it should be blocked. They check the firewall logs to see if any suspicious traffic is being dropped.

When something breaks — for example, the sales team reports they cannot access a cloud-based CRM — the IT professional checks the firewall logs. They see that outbound traffic to the CRM's IP address is being blocked. They then create a specific allow rule for that IP and port, apply it before the default deny rule, and test again.

Common tools used in this process:
- Packet capture tools like Wireshark to inspect traffic.
- Firewall log analysers to review dropped packets.
- Network mapping tools like Nmap to verify open ports.
- Remote access tools like SSH or RDP to manage the firewall securely.
- Backup software to save firewall configurations before making changes.

## Exam focus

The CompTIA A+ Core 2 220-1202 exam tests network security and firewall configuration in objective 2.4. You will not be asked to configure a specific brand of firewall from memory. Instead, the exam focuses on conceptual understanding, common scenarios, and troubleshooting steps.

Here are the exact concepts they love to test:

- Default-deny vs. default-allow: Questions will present a scenario where a service stops working after a firewall change. The correct answer often involves the default-deny rule — if no rule explicitly allows traffic, it is blocked. You need to know that blocking all inbound traffic by default is the most secure approach.
- Port and protocol identification: You will be given a scenario (e.g., a user cannot access the internet) and must identify that port 80 (HTTP) or port 443 (HTTPS) needs to be open. Expect matching questions linking common ports to services: 80/HTTP, 443/HTTPS, 25/SMTP, 110/POP3, 143/IMAP, 3389/RDP, 22/SSH, 21/FTP.
- Stateful vs. stateless: The exam may ask why a connection fails. The trap is that a stateless firewall sees only individual packets, while a stateful firewall understands connection state. If the firewall is not stateful, returning traffic from an allowed outbound connection may be blocked.
- DMZ placement: You must understand that a DMZ sits between the internal network and the internet. Servers that need to be publicly accessible (like web and email servers) go in the DMZ, not on the internal network. A common wrong answer places a database server in the DMZ — that is insecure because the database should be on the internal network, only accessible by the web server via a specific rule.
- TCP/IP inspection: Questions may ask about deep packet inspection (DPI). The exam expects you to know that DPI looks beyond the header into the payload of the packet, allowing the firewall to identify threats like malware or policy violations even if they use allowed ports.
- Implicit deny: Any traffic that does not match an explicit permit rule is denied. This is the foundation of firewall security. Expect a question like: 'A firewall has rules allowing web traffic on port 80 and port 443. A user tries to access a service on port 8080. What happens?' The answer is the traffic is denied because no rule permits it.
- Rule order: Firewalls process rules in top-down order. A common trap is placing a general allow rule before a more specific block rule, making the block ineffective. You must understand that the first matching rule is applied.

Traps the exam sets:
- They will describe a scenario where a user can browse the web but cannot send email. The correct answer is that port 25 (SMTP) outbound is blocked. The wrong answers might suggest the web proxy is broken or DNS is failing.
- They will present a network diagram with a firewall connected to three zones. The question asks where a public web server should be placed. The trap answer is 'on the internal network' — the correct answer is 'in the DMZ'.
- They will list firewall rules in an incorrect order and ask why a user cannot access a specific website. The answer is that a preceding deny rule blocks the traffic before the allow rule is processed.

Key definitions to memorise:
- Firewall: a device or software that filters traffic based on rules.
- ACL: a set of rules applied to a firewall interface.
- DMZ: a network segment isolated from the internal network and internet.
- Stateful inspection: tracking the state of connections to allow return traffic.
- Default-deny: blocking all traffic unless explicitly allowed.

## Step by step

1. **Identify network segments and zones** — You map out the network into trusted (internal LAN), semi-trusted (DMZ), and untrusted (guest Wi-Fi, internet) zones. This determines where the firewall interfaces connect and what traffic should be allowed between each zone.
2. **Define the firewall rule policy** — You decide on the default action — typically default-deny for inbound traffic. Then you plan specific allow rules based on what services need to communicate. For example, allow web traffic to the DMZ web server on ports 80 and 443 from the internet.
3. **Translate the policy into firewall rules (ACL entries)** — You enter the rules into the firewall management interface, paying close attention to order. Place the most specific rules first (e.g., allow a single trusted IP to SSH into the firewall) and the broader rules later (e.g., allow all web traffic).
4. **Apply rules to the correct interfaces and direction** — Each firewall rule must be assigned to a specific interface (e.g., the internet-facing interface) and direction (inbound = traffic coming into that interface, outbound = traffic leaving that interface). Incorrect assignment is a common cause of broken connectivity.
5. **Test the firewall rules** — You simulate traffic from each zone to verify that allowed services work and blocked services are denied. You check the firewall logs for unexpected drops or allowed traffic. This step catches misconfigurations before they affect users.
6. **Monitor and maintain the firewall** — You regularly review logs for suspicious activity, update rules as the network changes (e.g., adding a new server), and apply firmware updates to the firewall device itself to patch security vulnerabilities.

## Comparisons

### Stateless Firewall (Packet Filtering) vs Stateful Firewall

**Stateless Firewall (Packet Filtering):**
- Checks only individual packet headers (source/destination IP, port, protocol).
- Does not track connection state — treats each packet in isolation.
- Less memory usage and faster, but less secure — return traffic needs explicit rules.
- Suitable for simple networks with low security requirements.

**Stateful Firewall:**
- Maintains a state table to track the state of active connections.
- Allows return traffic automatically for connections initiated from the trusted side.
- More secure because it can detect spoofed packets that do not match an established session.
- Suitable for most modern networks requiring strong security.

### DMZ (Demilitarised Zone) vs Internal Network (LAN)

**DMZ (Demilitarised Zone):**
- Contains public-facing servers like web and email servers.
- Accessible from the internet on specific ports (e.g., 80, 443).
- Should not be able to initiate connections to the internal LAN.
- Placed between the internet and the internal network for isolation.

**Internal Network (LAN):**
- Contains private devices like workstations, printers, and internal databases.
- Not directly accessible from the internet — all inbound traffic must pass through the firewall.
- Can access the DMZ for management but DMZ cannot access LAN.
- The most trusted zone in the network.

### Default-Deny Policy vs Default-Allow Policy

**Default-Deny Policy:**
- Blocks all traffic unless a specific rule permits it.
- More secure — minimises accidental exposure of services.
- Requires more initial effort to create explicit allow rules.
- Preferred for production networks and security-conscious environments.

**Default-Allow Policy:**
- Allows all traffic unless a specific rule blocks it.
- Less secure — an error in rule configuration leaves services exposed.
- Easier to set up initially because everything works by default.
- Sometimes used for temporary testing, but never for permanent deployment.

## Diagram

_A typical firewall configuration showing three network segments: DMZ, internal LAN, and guest Wi-Fi, each with different access rules enforced by the firewall._

```mermaid
flowchart TD
    A[Internet / Untrusted Network] --> B[Firewall - Public Interface]
    B --> C[DMZ Segment]
    C --> D[Web Server: ports 80,443]
    C --> E[Email Server: ports 25,110,143]
    B --> F[Internal Network Interface]
    F --> G[Internal LAN - Trusted]
    G --> H[Employee Workstations]
    G --> I[Internal Database Server]
    B --> J[Guest Wi-Fi Interface]
    J --> K[Guest Network - Untrusted]
    K --> L[Internet Only - No Internal Access]
```

## Common misconceptions

- **Misconception:** A firewall is only needed for protecting against hackers from the internet — internal threats are not a concern. **Reality:** Firewalls should also segment internal networks to prevent lateral movement. An infected workstation on the internal LAN should not be able to access the server segment or other workstations directly. (Beginners often focus only on external threats because they have heard about hackers on the news. But many breaches start from inside — an employee clicking a phishing link, for example.)
- **Misconception:** If you have a firewall, your network is completely safe and you do not need any other security measures. **Reality:** A firewall is just one layer of defence. It cannot stop social engineering, weak passwords, or malware that enters through allowed traffic on port 80/443. You still need antivirus, patch management, and user training. (The term 'firewall' sounds like an impenetrable wall. People naturally assume it alone provides total protection, not realising that many attacks bypass firewalls completely.)
- **Misconception:** Firewall rules should be as permissive as possible to avoid breaking anything. **Reality:** The correct approach is least privilege — only allow the minimum necessary traffic. Overly permissive rules create security holes and defeat the purpose of the firewall. (IT beginners are often afraid of breaking services, so they open ports broadly. They do not yet understand that security requires intentional restriction.)
- **Misconception:** A hardware firewall and a software firewall are completely different and perform different functions. **Reality:** Both perform essentially the same function — filtering traffic — but hardware firewalls are dedicated devices that protect an entire network, while software firewalls run on individual computers and protect only that device. (The different names ('hardware' vs 'software') make people think the technology is fundamentally different, when in reality the core function is identical.)
- **Misconception:** Changing the default port for a service (like running SSH on port 2222 instead of 22) is just as effective as a firewall rule. **Reality:** Changing the port is security by obscurity — it slows down casual scanners but does not stop a determined attacker. A firewall rule that blocks all traffic except from specific IP addresses is far more secure. (Beginners often hear about 'security through obscurity' as a tactic, but they overestimate its effectiveness compared to actual access control.)

## Key takeaways

- A firewall blocks or permits network traffic based on a set of rules called an access control list (ACL).
- Default-deny is the most secure firewall policy: block everything, then allow only what is needed.
- The DMZ is a separate network segment for public-facing servers — never place them on your internal LAN.
- Stateful inspection allows return traffic for established connections — stateless firewalls need explicit rules for return traffic.
- Firewall rules are processed top-down — the first matching rule is applied, so order matters.
- Deep packet inspection (DPI) examines the content of packets, not just headers, to detect threats hiding in allowed traffic.
- A firewall only protects against network-based threats — it does not stop human error or weak passwords.
- Changing a service's default port is not a replacement for a proper firewall rule blocking unauthorised access.

## FAQ

**What is the difference between a hardware firewall and a software firewall?**

A hardware firewall is a physical device that protects an entire network, while a software firewall is a program installed on a single computer that protects only that device. Both filter traffic using the same principles.

**Does a firewall block viruses and malware?**

A basic firewall does not block viruses — it only controls what traffic is allowed in and out. A next-generation firewall (NGFW) with deep packet inspection can detect and block some malware, but you still need dedicated antivirus software for full protection.

**Why can I browse the internet but not send email after a firewall change?**

Web browsing uses ports 80 and 443, while outgoing email (SMTP) uses port 25. The firewall likely allows outbound web traffic but blocks outbound SMTP traffic. You need to add a rule allowing outbound traffic on port 25 to the email server.

**What does 'default-deny' mean in firewall configuration?**

A default-deny policy means the firewall blocks all traffic that is not explicitly permitted by a rule. This is the most secure approach because it ensures no unwanted traffic gets through accidentally.

**Can I use the same firewall rule for both inbound and outbound traffic?**

No, you typically need separate rules for inbound and outbound traffic on each interface. A rule direction specifies whether it applies to traffic entering the interface (inbound) or leaving the interface (outbound).

**Why does rule order matter in a firewall?**

Firewalls process rules from top to bottom and apply the first matching rule. If a broad deny rule is placed before a specific allow rule, traffic that should be allowed will be blocked. You must order rules from most specific to most general.

## Check your understanding

1. **What is the primary difference between a stateful firewall and a stateless firewall?**

   Answer: A stateful firewall tracks the state of active connections and automatically allows return traffic, while a stateless firewall checks each packet individually and does not remember connection state.

2. **You have configured a firewall with a default-deny outbound rule. A user cannot access a website on port 443. What is the most likely solution?**

   Answer: Create an outbound allow rule for port 443 (HTTPS) to the destination IP or network, placed before any broader deny rule.

3. **Where should you place a company's public web server to maximise security?**

   Answer: In a DMZ (demilitarised zone), which is a separate network segment isolated from both the internal LAN and the internet by the firewall.

4. **What is the purpose of an implicit deny rule at the end of a firewall access control list?**

   Answer: It ensures that any traffic not matching an explicit permit rule is automatically denied, providing a baseline of security.

5. **A technician changes the SSH port on a server from 22 to 2222, hoping to improve security. Why is this not a substitute for a firewall rule?**

   Answer: Changing the port only hides the service from casual scanners (security by obscurity) but does not restrict which IP addresses can connect — a firewall rule blocking all traffic except from trusted IPs is needed for real security.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/a-plus-220-1202/network-security-and-firewall-configuration