Skip to content

🧱 05-07: ACLs, DMZ & Segmentation

📌 Access Control Lists (ACLs) on Routers/Switches

An Access Control List (ACL) is a set of rules configured directly on a router or switch that permits or denies traffic based on header fields — conceptually, this is exactly the same idea as the stateless packet filtering covered in 05-02: Packet-Filtering Firewalls, just implemented on networking hardware instead of a general-purpose firewall device.

Example ACL (Cisco-style pseudocode)

access-list 101 permit tcp 10.0.0.0 0.0.0.255 any eq 443
access-list 101 permit tcp 10.0.0.0 0.0.0.255 any eq 80
access-list 101 deny   ip  any any

This says: allow HTTPS and HTTP from the 10.0.0.0/24 network to anywhere, and deny everything else. Notice it reads almost identically to a stateless iptables rule set.

ACLs vs. Dedicated Firewall Rules

Aspect Router/Switch ACL Dedicated Firewall (iptables/NGFW)
Primary purpose Traffic engineering + basic security on network infrastructure Dedicated security policy enforcement
State awareness Usually stateless (some modern routers support reflexive/stateful ACLs) Stateful by default (see 05-03: Stateful Firewalls)
Performance Extremely fast — processed in hardware (ASICs) on many switches/routers Slower, especially with deep inspection, but far more capable
Granularity IP/port/protocol level Can range from IP/port up to full Layer 7 application awareness (NGFW)
Placement Applied per-interface, often at the edge of a routing domain Placed at trust-zone boundaries, can be host-based or network-based
Typical use First line of coarse filtering, especially between routed subnets Primary policy enforcement point for a trust boundary

💡 In practice, ACLs and firewalls are complementary, not competing: an organization might use router ACLs to do cheap, fast, coarse filtering close to the network core (dropping obviously unwanted traffic before it even reaches the firewall), while a stateful/NGFW firewall does the detailed policy enforcement at the actual trust boundary. This layering is a form of defense-in-depth, the same principle discussed at the end of this lesson.

🏰 The DMZ (Demilitarized Zone)

A DMZ is a separate network segment that sits between your trusted internal network and the untrusted public Internet, specifically designed to host servers that need to be reachable from the outside world (web servers, mail servers, public DNS servers) — without exposing your actual internal network to that same level of risk.

The name borrows from the military term for a buffer zone between two opposing forces: neither side fully controls it, and it exists specifically to create separation.

Why Not Just Put Public Servers on the Internal Network?

If your public-facing web server sits on the same network segment as your internal file servers, HR database, and employee workstations, then compromising that one internet-facing server (which is, by definition, the most exposed machine you own) hands the attacker a direct foothold to attack everything else on that same internal network.

Typical DMZ Architecture

                    Internet
                        │
                 ┌──────┴───────┐
                 │  Firewall #1  │  (Internet ↔ DMZ)
                 └──────┬───────┘
                        │
              ┌─────────┴──────────┐
              │        DMZ          │   e.g. 192.168.100.0/24
              │  (Web, Mail, DNS)   │
              └─────────┬──────────┘
                 ┌───────┴───────┐
                 │  Firewall #2   │  (DMZ ↔ Internal)
                 └───────┬───────┘
                         │
              ┌──────────┴───────────┐
              │   Internal Network    │   e.g. 10.0.0.0/16
              │ (Employees, DB, HR)  │
              └───────────────────────┘

The Firewall Rules That Make a DMZ Work

Traffic Flow Policy
Internet → DMZ Allowed, but only to specific ports on specific DMZ hosts (e.g., 80/443 to the web server)
DMZ → Internal Network Denied by default, or extremely limited (e.g., only the web server can query the database server on one specific port)
Internal Network → DMZ Usually allowed (admins need to manage the DMZ servers)
Internal Network → Internet Allowed per organizational policy
Internet → Internal Network Denied entirely — nothing on the internal network should be directly reachable from the public Internet

💡 The critical design principle: if the DMZ web server is compromised, the attacker should NOT automatically gain access to the internal network. The DMZ-to-internal rule is the most important, most tightly restricted rule in the whole design — often limited to a single narrow path, like "the web server may only open a connection to the database server on port 5432, nothing else."

🧩 Network Segmentation as Defense-in-Depth

A DMZ is really just one specific, well-known application of a broader strategy: network segmentation — dividing a network into smaller zones so that a compromise in one zone doesn't automatically grant access to every other zone.

Recall from 01-05: IPv4 Subnetting & CIDR that subnetting lets you carve one large address space into smaller, logically distinct networks. Segmentation takes that a step further: each subnet is placed behind its own filtering point (a firewall, an ACL, or both), with policy explicitly defining what is and isn't allowed to cross between segments.

Example: Segmenting a Corporate Network

Segment Subnet Who/What Lives Here Access Policy
DMZ 192.168.100.0/24 Public web/mail/DNS servers Internet can reach specific ports; very limited outbound to internal
Employee LAN 10.10.0.0/24 Workstations, laptops Can reach internal servers and Internet; cannot be reached from Internet
Server/Data Segment 10.20.0.0/24 Databases, internal applications Reachable only from specific application servers, never directly from employee LAN or DMZ
Guest Wi-Fi 10.30.0.0/24 Visitor devices Internet access only — fully isolated from every other internal segment
Management/OT Segment 10.40.0.0/24 Network device management, industrial control systems Reachable only from a dedicated admin jump host

💡 Why bother with all this instead of one flat network? Because a flat network means one compromised device is one hop away from every other device. If an attacker phishes a single employee laptop on a flat network, they can often pivot straight to the database server. With proper segmentation, that same compromised laptop sits in the Employee LAN segment, which has no direct path to the Server/Data segment — the attacker has to find and exploit an additional weakness just to move one step further. Every segment boundary is another chance to detect and stop them.

Segmentation Is a Core Defense-in-Depth Principle

Defense-in-depth means layering multiple, independent security controls so that the failure of any single one doesn't lead directly to a full compromise. Segmentation embodies this by ensuring:

  • A compromised DMZ server doesn't equal a compromised internal network.
  • A compromised guest device doesn't equal a compromised corporate laptop fleet.
  • A compromised employee workstation doesn't equal direct database access.

Each boundary is an opportunity to apply the firewall and ACL techniques from earlier lessons (05-05: iptables Fundamentals, 05-06: Writing iptables Rules) — segmentation is the network architecture that gives those firewall rules something meaningful to enforce.

📌 Key Takeaways

  • ACLs on routers/switches apply the same stateless filtering logic as basic packet filters, usually processed extremely fast in hardware, but with less granularity than a dedicated firewall.
  • ACLs and dedicated firewalls are complementary layers, not substitutes for each other.
  • A DMZ is a buffer network segment for public-facing servers, isolated from both the raw Internet and the trusted internal network by separate firewall boundaries.
  • The most important rule in a DMZ design is the tightly restricted DMZ-to-internal path — a compromised DMZ host should not translate into internal network access.
  • Network segmentation generalizes the DMZ idea: dividing a network into zones, each behind its own filtering boundary, so a breach in one zone is contained.
  • Segmentation relies on subnetting (see 01-05: IPv4 Subnetting & CIDR) to create the distinct address spaces that firewalls/ACLs then enforce boundaries around.
  • A flat, unsegmented network turns a single compromised device into a springboard for attacking everything else — segmentation forces an attacker to work for every additional step.
  • Segmentation is a textbook example of defense-in-depth: no single control failure should compromise the whole network.