🏆 Project 08 — Capstone: Secure Network Design¶

Type: Design capstone Modules: 05 (Firewalls), 06 (DNS), 08 (VPN), 10 (Intrusion Detection & ML) Difficulty: ⭐⭐⭐⭐⭐

🎯 Objective¶

Design — on paper/diagram, not necessarily fully implemented — a secure small-business network that pulls together everything from the course: segmentation, firewall policy, DNS hardening, remote-access VPN, and a monitoring/detection layer.

🛠️ Scenario¶

A small business has:

An internal LAN with employee workstations and a file server.
A public-facing web server that customers need to reach.
Remote employees who need secure access to internal resources.
A requirement to detect intrusions, not just block known-bad traffic.

🧩 Tasks¶

🔹 Part A — Topology & Addressing¶

Design the network topology and subnetting (see 01-05: IPv4 Subnetting & CIDR), placing the public web server in a DMZ, separate from the internal LAN.

🔹 Part B — Firewall Policy¶

Define the firewall policy table — which zone pairs can talk, on which ports — at every network boundary (Internet↔DMZ, DMZ↔Internal, Internet↔Internal, Internal↔Internet). Reference the reasoning pattern from 05-07: ACLs, DMZ & Segmentation and 02-exercises/05-04-exercise.md.

🔹 Part C — DNS Architecture¶

Decide the DNS architecture and hardening measures (see 06-01: DNS Infrastructure and the DNS attack lessons, e.g. 06-05: DNS Cache Poisoning) to reduce cache-poisoning and DoS exposure — e.g., internal vs. external resolvers, DNSSEC, rate limiting.

🔹 Part D — Remote Access VPN¶

Add a remote-access VPN for employees. Decide the tunnel type and authentication approach, referencing 08-01: VPN Concepts & Types and 08-04: Building a VPN Tunnel.

🔹 Part E — Detection Layer¶

Place a NIDS sensor (see 10-02: NIDS vs. HIDS) at a chosen network chokepoint and justify the placement. Decide whether signature-based, anomaly-based, or both detection approaches fit this network (see 10-01: IDS/IPS Concepts).

🔹 Part F — Threat Model¶

Pick 3 attacks from earlier modules — e.g., ARP spoofing (03-04: ARP Spoofing Attacks), SYN flooding (04-01: TCP SYN Flooding), DNS cache poisoning (06-05: DNS Cache Poisoning) — and explain specifically how your design mitigates or detects each one.

✅ Verification Checklist¶

This is a design capstone — "verification" means design completeness, not running a command:

Topology diagram (described in text/table) with at least three distinct zones and their subnets.
A complete firewall policy table covering every zone pair.
DNS architecture decision with at least one specific hardening measure justified.
VPN tunnel type and authentication approach chosen and justified.
NIDS placement chosen and justified, with a detection-approach decision (signature/anomaly/both).
Threat model covering 3 specific attacks and how the design addresses each.

📦 Deliverables¶

A network diagram (can be a described/tabular layout rather than a drawn image).
The firewall policy table.
The written threat-model analysis (3 attacks, how each is mitigated/detected).

🚀 Stretch Goals¶

Cost-estimate the design using real or example hardware/software pricing.
Write a short incident-response runbook for one of your three chosen attacks: what would the on-call analyst actually do, step by step, if the NIDS fired an alert for it?
Extend the threat model to a 4th attack from Module 09 (TLS) or Module 07 (Cryptography), such as a downgrade attack or a mis-issued certificate.

See also notes: [[01-05-ipv4-subnetting-and-cidr]], [[05-07-acls-dmz-and-segmentation]], [[06-01-dns-infrastructure]], [[08-01-vpn-concepts-and-types]], [[10-01-ids-ips-concepts]], [[10-02-nids-vs-hids]]