Firewalls and VPNs.
Module 3 is about defence. We start with the two tools everyone has heard of but few people really understand: the firewall, which guards the doors, and the VPN, which builds a private tunnel.
The firewall: a security guard at the gate
Think of a gated community in Gachibowli. At the gate, a security guard has a list of rules: residents enter, delivery boys go only to the service gate, unknown cars are stopped. A firewall does the same for network traffic. It looks at each packet (remember Lesson 3) and decides: allow or block, based on rules.
| Rule | Meaning |
|---|---|
| Allow IN to port 443 from anywhere | Anyone can visit our website (HTTPS) |
| Allow IN to port 22 only from office IP 49.205.10.20 | Only our office can manage the server by SSH |
| Block IN to port 3389 from anywhere | Nobody from outside gets remote desktop |
| Block everything else IN | Default deny: if it's not allowed, it's blocked |
Good firewalls follow default deny: block everything, then allow only what's needed. Weak setups do the opposite: allow everything, then try to block bad things. The second way always misses something.
A server only hosts a website. Which incoming ports should the firewall allow from the internet?
Allow only what the job needs. Every extra open door increases the attack surface.
Types of firewalls you'll hear about
- Host firewall: on each computer (Windows Defender Firewall, Linux
ufw). - Network firewall: a device protecting the whole office network (Fortinet, Palo Alto, Cisco, pfSense).
- Next-generation firewall (NGFW): also understands applications ("block YouTube, allow Teams") and can spot some attacks.
- WAF (Web Application Firewall): protects websites from attacks like SQL injection (Module 4). Cloudflare is a well-known example.
Segmentation: don't put everything in one room
Imagine a hospital where the visitors' waiting area, the pharmacy store and the operating theatre are all one big room. One problem anywhere becomes a problem everywhere. Network segmentation splits a network into zones with firewalls between them: guest Wi-Fi, staff computers, servers, payment machines. If malware hits a guest phone, it can't jump to the billing server.
Your home router probably has a guest Wi-Fi option. Use it for visitors and smart devices like cheap cameras and smart plugs. That's segmentation at home.
The VPN: a private tunnel
A VPN (Virtual Private Network) creates an encrypted tunnel from your device to a VPN server. Everything travels inside that tunnel.
What VPNs are really used for
- Companies: employees working from home connect through a VPN to reach internal systems safely, as if they were in the office.
- Public Wi-Fi: protects your traffic from people on the same café network.
- Privacy from your internet provider: they see you're using a VPN, not which sites you visit.
What a VPN does NOT do
- It does not stop phishing, malware or scams.
- It does not make you anonymous: the VPN company can see your traffic instead.
- "Free VPN" apps often make money by selling your data, the exact opposite of privacy.
Not good. A VPN doesn't need your contacts or SMS. Many free VPNs collect and sell data. Use your company's VPN, or a reputable paid one, or none.
Good. This is exactly what VPNs are for, with 2FA.
Which statement about VPNs is TRUE?
That's its real job. It doesn't stop scams or make you invisible.
Your task (10 min)
On Windows: search "Windows Defender Firewall" and check it's On for private and public networks. At home: open your router's settings (often 192.168.0.1 or 192.168.1.1, login is on the router sticker) and check whether a guest network is available. Change the router's admin password if it's still the default.
Lesson 9 complete!
You know what firewalls do, how rules work, what network segmentation is, and what a VPN does (and doesn't) do. Next: encryption, explained simply.
Next: Encryption, simply explained →