Firewalls and segmentation
A firewall is a policy applied at a boundary. Almost everything interesting about one is the choice of boundary, not the choice of rules — a perfect ruleset in the wrong place protects nothing, and a crude one in the right place protects a great deal.
Why the boundary is where it is
That office has one switch and three VLANs on it — staff, guests, and servers. Traffic within a VLAN never leaves layer 2 and no firewall can see it. Traffic between VLANs must go through a layer-3 device, and that forced detour is the entire point: it creates a place to stand.
Segmentation is what turns one compromised laptop into a contained problem instead of a company-wide one. The guest network is the clearest case — it needs the Internet and it needs nothing else on the premises, and putting it in its own VLAN says so structurally rather than hopefully.
Stateful, and the two ways to say no
A stateful firewall remembers connections it allowed outward so it can let the replies back in. That is what makes "allow outbound, deny inbound" a workable default instead of a description of a network nobody can use — and it is the same table idea as
NAT, doing a different job.
When it does say no, it has two ways to do it, and they are distinguishable from outside:
| Reject | Drop | |
|---|---|---|
| Sends | A TCP reset or ICMP error | Nothing at all |
| Client sees | An instant failure | A timeout, after retries |
| Tells a scanner | “Something is here” | Nothing |
That is the same distinction you met in track 2 as fast failure versus slow failure, now from the other side of the boundary.
Going and looking
You now have a model of the whole path: names, addresses, routes, transports, TLS, HTTP, APIs and the machines in between. The Network Diagnostics module is where you can point the same four tools every operator uses at it — simulated by default, with a live mode behind an explicit opt-in, and a badge that always tells you which one you are in.
Key takeaways
- A firewall is a policy at a boundary, and choosing the boundary matters far more than choosing the rules.
- Traffic inside one segment never crosses the firewall, so a perimeter-only design does nothing against lateral movement.
- Segmentation forces traffic through a layer-3 device, which is what creates somewhere for policy to be applied at all.
- Stateful inspection remembers outbound connections so replies can return — the same table idea as NAT, doing a different job.
- Rejecting fails fast and reveals that something is there; dropping reveals nothing and makes legitimate clients wait out a timeout.