Stateless, stateful, and next-gen
- Stateless ACL: per-packet rules with no memory between packets. Cheap, fast, has to permit both directions of every flow explicitly. Survives as edge "deny by IP/port" rules.
- Stateful firewall: tracks connection state (Netfilter
conntrack, pf state tables). One rule for outbound HTTPS automatically permits the matching inbound packets. Default for any modern firewall. - Next-gen firewall (NGFW): stateful plus application-layer awareness, TLS interception (via injected root certs on managed devices), user identity integration, and IPS signatures. The blurred line between firewall, IDS, and proxy.
IDS placement matters more than the engine
You can buy or self-host any IDS (Suricata, Snort, Zeek). What changes its yield is where you put it:
- Perimeter: between your network and the internet. Catches scans and known-bad outbound C2. Sees mostly TLS, so deep inspection without interception is limited.
- East-west: between segments inside the network. Catches lateral movement, which is what every modern attacker does after the initial foothold. Most undefended networks have no east-west visibility at all.
- Endpoint-based (EDR): not an IDS in the classical sense, but the modern equivalent for catching post-foothold behavior. Network IDS plus EDR is a much stronger combo than either alone.
OpenVPN, WireGuard, IKEv2
Three live VPN protocols, three different trade-offs:
- OpenVPN: TLS-based, very flexible, mature. Slow because its userspace data plane does TLS framing per packet. Still wins on the most restrictive networks (looks like HTTPS).
- WireGuard: ~4000 lines, kernel-resident, modern crypto (Curve25519, ChaCha20-Poly1305, BLAKE2). Much faster, much simpler config. Default new choice. Limited NAT-traversal options; needs a stable IP or a helper.
- IKEv2 / IPsec: native support on every major OS (mobile especially good). Survives network changes (MOBIKE). The right choice for managed device fleets where you cannot install third-party clients.
What zero-trust requires
"Zero-trust" is overloaded. The minimum credible definition (per NIST SP 800-207):
- No implicit trust based on network location. Every request is authenticated, regardless of whether it comes from inside or outside the corporate network.
- Strong identity per workload and per user. Service accounts get short-lived, scope-limited credentials; users get phishing-resistant MFA.
- Per-request authorization with policy that considers device posture, user role, and behavior. Not just "is this user logged in" but "should this user be doing this from this device right now."
- End-to-end encryption between services (mTLS), not just at the network edge.
- Continuous validation: trust expires. A 12-hour authenticated session in a zero-trust system still re-checks posture for every sensitive request.
What zero-trust does not mean: throwing away firewalls and VPNs (defence in depth still applies), or buying a product labelled "zero-trust" (it is an architecture, not an SKU).
Network segmentation, briefly
Cut blast radius by separating networks:
- VLANs at the switch level keep broadcast domains apart. Good for separating untrusted clients from servers.
- Microsegmentation via host-firewall rules or service mesh policy. Most flexible; requires identity per workload.
- Air gap for the highest sensitivity (industrial control, classified). Provably no path; pays in operational pain.
Segmentation is where most real defensive work happens after the cloud migration. The 2017 Equifax breach was a network where one foothold reached too many systems because too little separation existed inside.