Network Security Architecture: Firewalls, VLANs, and DMZ Design

What Is Network Security Architecture?

Network security architecture is the deliberate arrangement of hardware, software, and policies to protect data as it moves through a network. Three foundational tools in that arrangement are firewalls, VLANs, and DMZ design. Together they reduce the attack surface — the total number of paths an attacker could use to reach sensitive resources.

Firewalls: The First Line of Defense

A firewall is a device or software that inspects network traffic and decides whether to allow or block it based on a rule set. A stateful firewall tracks the state of active connections, not just individual packets. This means it can tell the difference between a reply to a legitimate outbound request and an unsolicited inbound connection — blocking the second even if the port would otherwise be open.

Firewall rules are processed in order, top to bottom. The first rule that matches a packet is applied; remaining rules are not evaluated. Most firewalls end their rule set with an implicit deny-all rule, so any traffic not explicitly permitted is dropped. When writing rules, always follow the principle of least privilege: permit only the services that are required and deny everything else.

In a lab environment such as pfSense, rules are applied per interface. A common beginner mistake is applying a rule to the wrong interface direction (inbound vs. outbound). Always confirm which interface a rule applies to and in which direction traffic flows before testing.

VLANs: Segmenting the Internal Network

A Virtual LAN (VLAN) is a logical grouping of network ports that behaves as if those ports are on a separate physical switch, even though they share the same physical hardware. VLANs are defined by 802.1Q tags inserted into Ethernet frames.

VLAN segmentation limits lateral movement. If an attacker compromises a workstation on VLAN 10 (staff desktops), they cannot directly reach servers on VLAN 20 (database servers) without traffic crossing a Layer 3 device — a router or multilayer switch — that applies access control rules. By blocking inter-VLAN routing where it is not needed, you contain threats within a smaller zone.

A trunk port carries traffic for multiple VLANs between switches using 802.1Q tags. An access port carries traffic for a single VLAN and connects to end devices. Misconfigured trunk ports are a common vulnerability; restrict allowed VLANs on every trunk to only those required.

DMZ Design: Protecting Public-Facing Services

A DMZ (demilitarized zone) is a separate network segment that sits between the untrusted internet and the trusted internal LAN. Servers that must be reachable from the internet — such as web servers, mail relays, or DNS servers — are placed in the DMZ.

The classic three-leg DMZ uses a single firewall with three interfaces:

• WAN interface — connects to the internet
• DMZ interface — connects to public-facing servers
• LAN interface — connects to internal users and resources

Firewall rules for a DMZ follow a strict pattern:

• Internet → DMZ: permit only the required ports (for example, TCP 443 for HTTPS)
• DMZ → LAN: deny all (DMZ servers should never initiate connections into the LAN)
• LAN → DMZ: permit where needed for administration
• LAN → Internet: permit outbound as required

This design means that if a DMZ server is compromised, the attacker still faces the firewall before reaching internal systems.

Using Nmap to Verify Rules

Nmap is a free, open-source port scanner used in this course to verify that firewall rules work as intended. A basic scan (`nmap -sV <target IP>`) shows open ports and service versions visible from the scanning host. After configuring firewall rules, run an Nmap scan from a host that represents an attacker's position (for example, from outside the firewall) and confirm that only permitted ports appear open. Any port that appears open when it should be blocked indicates a rule error.

Lab safety note: Only run Nmap against systems you own or have explicit written authorization to scan. Unauthorized port scanning may violate the Computer Fraud and Abuse Act and similar laws. In this course, scans are performed only within the isolated lab environment.

Network Diagramming

A clear network diagram communicates your security decisions to colleagues, auditors, and management. Standard practice is to use recognizable symbols for firewalls, switches, routers, and servers. Label each segment with its VLAN ID and IP subnet. Annotate each design decision with a brief rationale — for example, "VLAN 30 isolates IoT devices because their firmware update processes are uncontrolled and represent elevated risk."

Why This Matters for Your Credentials

CompTIA Security+ covers network security concepts including firewall rule design, network segmentation, and DMZ architecture. CompTIA CySA+ extends this to monitoring and detecting anomalies across segmented networks. ISC2 CC includes fundamental network security principles. Understanding how these controls layer together is tested across all three credentials and is a core skill in daily security operations work.