Network Security Basics: Firewalls, VPNs and Ports

Every attack you have studied so far travels over a network before it reaches an application. Understanding how traffic flows, and where you can filter it, is therefore fundamental to defense. In this lesson you'll learn what ports are, how firewalls decide what to allow, what VPNs actually protect, and the principles behind segmenting a network so one compromised machine cannot reach everything else.

Ports: The Doors of a Machine

An IP address identifies a machine; a port number identifies a service on that machine. Ports range from 0 to 65535, and common services use well-known numbers:

22: SSH (remote administration)
80: HTTP and 443: HTTPS (web traffic)
25 and 587: email delivery and submission
3306: MySQL, 5432: PostgreSQL

Every open port is a potential entry point. The golden rule of hardening is simple: close everything you are not deliberately using. A database that only the application server needs should never accept connections from the public internet. You can check what a server exposes with standard tools:

bash

# List listening ports on a Linux server you administer
ss -tulpn

# Verify from outside that only 80 and 443 answer
nmap -Pn your-own-server.example.com

Only scan systems you own or have written permission to test; unauthorized scanning is illegal in many jurisdictions.

Firewalls: Filtering Traffic by Rules

A firewall inspects packets and applies rules: allow, or drop. The safest posture is default deny, meaning everything is blocked unless a rule explicitly permits it. A minimal web server policy looks like this:

bash

# UFW (Linux) - default deny, allow only what is needed
ufw default deny incoming
ufw default allow outgoing
ufw allow 443/tcp   # HTTPS
ufw allow 80/tcp    # HTTP redirect to HTTPS
ufw allow from 203.0.113.10 to any port 22  # SSH only from admin IP
ufw enable

Firewalls come in layers: network firewalls at the perimeter, host firewalls on each machine, and web application firewalls (WAFs) that understand HTTP and can block patterns like SQL injection attempts. Cloud providers add security groups, which are per-server firewalls configured in the dashboard. Defense in depth means using several of these at once so one mistake is not fatal.

VPNs: Private Tunnels Over Public Networks

A VPN (virtual private network) creates an encrypted tunnel between your device and a VPN server. Everything inside the tunnel is unreadable to the coffee-shop Wi-Fi, your ISP, or anyone on the path. Two common uses:

Remote access VPNs let employees reach internal systems as if they were in the office, without exposing those systems publicly.
Site-to-site VPNs connect two office networks securely across the internet.

Be realistic about what a VPN does not do: it does not make you anonymous, it does not stop phishing or malware, and you must trust the VPN provider, since your traffic exits through them. For company infrastructure, a modern pattern is to put administrative interfaces like SSH and databases behind a VPN or zero-trust access proxy, so they are simply unreachable from the open internet.

Network Segmentation and Zero Trust

Flat networks, where every device can talk to every other device, turn one infected laptop into a company-wide incident. Segmentation splits the network into zones: guest Wi-Fi cannot reach servers, the web tier can reach the database tier only on port 5432, and management interfaces live in their own zone. The zero trust philosophy goes further: never trust a connection just because it comes from the internal network; authenticate and authorize every request regardless of origin.

Key Takeaways

Ports are service endpoints; every open port increases attack surface, so close all unused ones.
Firewalls should default deny and allow only explicitly needed traffic, ideally at several layers.
Restrict administrative ports like SSH to specific IPs or place them behind a VPN.
VPNs encrypt traffic in transit but are not anonymity or anti-malware tools.
Segment networks and adopt zero trust so a single compromise cannot spread everywhere.

Next lesson: we move back to the browser and explore Security Headers and Browser Protections.