Chapter 4 · Network Security· Beginner· ~13 min

Firewalls, IDS, VPNs

The defensive trio that decides what may go where, watches what does, and lets remote endpoints behave as if they were inside.

You will learn

  • What a firewall actually does, and where rules belong
  • The difference between IDS and IPS
  • What a VPN protects and what people get wrong about VPNs
  • The shape of a modern defense, and where "zero trust" fits

Firewalls: rules at a boundary

A firewall is a control that decides which traffic may cross a boundary, based on a list of rules. The rules typically match on source IP, destination IP, port, and protocol.

Three places they live:

  • Network firewall. A box (or virtual appliance) at the edge of your network, gating traffic to the internet.
  • Host firewall. On the device itself: iptables/nftables on Linux, Windows Defender Firewall, macOS PF. Cheaper to operate, more granular.
  • Application firewall (WAF). Inspects HTTP requests for malicious patterns, SQL injection signatures, suspicious user agents, oversize bodies.

Two design choices matter: default-deny (block everything, allow what's explicitly listed) is almost always right; stateful firewalls track connections so return traffic for an outgoing request doesn't need its own rule.

A firewall doesn't inspect intent

It looks at addresses and ports. If port 443 is open to the world, every legitimate HTTPS site and every malicious one looks the same to it.

IDS / IPS: watching for the bad stuff

An Intrusion Detection System watches traffic and raises alerts on suspicious patterns. An Intrusion Prevention System does the same and also blocks. Two flavors:

  • Signature-based. Match traffic against a library of known-bad patterns. Fast, low false-positive rate, blind to anything new.
  • Anomaly-based. Build a baseline of "normal" and flag deviation. Catches novel things, much louder.

Snort and Suricata are the long-standing open-source examples. In practice, IDS/IPS alerts feed into a SIEM (Security Information and Event Management) where they're combined with other signals before a human looks at anything.

VPNs: a tunnel, nothing more

A Virtual Private Network creates an encrypted tunnel between your device and a VPN server. Traffic enters the tunnel, comes out the other end, and proceeds normally from there.

What a VPN protects:

  • The link between you and the VPN server, hiding it from local observers (your ISP, the coffee-shop network).
  • Your apparent IP address from sites you visit, they see the VPN server's.

What a VPN does not do:

  • Encrypt the second hop. Once traffic leaves the VPN server, it's back on the open internet.
  • Make you anonymous. The VPN provider knows where the traffic came from and where it's going.
  • Protect against tracking by login, browser fingerprinting, or compromised endpoints.

Enterprise VPNs (corporate "dial-in") serve a different purpose: they put your remote device on the company network so you can reach internal services.

VPN marketing is mostly noise

Consumer VPNs are useful for two narrow things: shifting which network sees your traffic, and changing your apparent location. They are not the privacy panacea their ads suggest.

The shape of a modern defense

The textbook picture is a fortress: hard outside, soft inside. The modern picture is called zero trust: don't trust anyone, on any network, until they prove who they are and what they may do.

In practice, layered controls:

  • Network firewalls to limit attack surface.
  • Strong identity and short-lived credentials for every service.
  • Mutual TLS or signed tokens between services.
  • Host-level firewalls and EDR (endpoint detection & response).
  • Centralized logging and detection.
  • Sane network segmentation: production isolated from staging from corporate from guest Wi-Fi.

No one piece stops everything. The point is that an attacker has to defeat several at once.

Take the quiz