Skip to main content

Network Segmentation and Firewalls

As cyber threats evolve, organizations must adopt strong network security strategies to minimize attack surfaces and contain potential breaches. Network segmentation and firewalls play a critical role in this by restricting unauthorized access, limiting lateral movement of attackers, and ensuring that only necessary communication occurs between different network zones.

In this lesson, we will explore the concepts of network segmentation, the role of firewalls, their types, and how they work together to enhance network security.

What is Network Segmentation?​

Network segmentation is the practice of dividing a network into multiple isolated sections (or segments) to improve security, performance, and manageability. This ensures that if one part of the network is compromised, the attacker cannot easily access other sections.

Types of Network Segmentation​

1. Physical Segmentation​

  • Uses separate hardware (switches, routers) to divide networks physically.
  • Example: A company has separate physical networks for employees, guests, and IoT devices.

2. Logical Segmentation (VLANs - Virtual Local Area Networks)​

  • Uses VLANs to create separate network segments on the same physical infrastructure.
  • Example: A university separates student, faculty, and administrative networks using VLANs.

3. Microsegmentation​

  • More granular segmentation that isolates workloads within a network.
  • Typically implemented in Zero Trust Architecture (ZTA) and software-defined networking (SDN).
  • Example: A data center might use microsegmentation to ensure that only specific applications communicate with each other.

4. Application-Based Segmentation​

  • Restricts access to network resources based on user roles, devices, and applications.
  • Example: Only finance department employees can access accounting software servers.

Benefits of Network Segmentation​

  • Improves Security: Limits the spread of malware or unauthorized access.
  • Reduces Lateral Movement: Prevents attackers from moving across an entire network if they gain access.
  • Enhances Performance: Reduces unnecessary traffic in different segments.
  • Simplifies Compliance: Helps organizations meet regulatory standards (e.g., PCI DSS, HIPAA).

Example of a Segmented Network​

Consider a hospital network that includes:

  • Medical Devices (MRI machines, patient monitors) → Isolated VLAN
  • Administrative Computers (HR, payroll) → Separate VLAN
  • Guest Wi-Fi (Patients, visitors) → Dedicated guest network

If a hacker compromises a visitor’s laptop on the guest network, segmentation ensures they cannot access critical patient data.

Firewalls: The First Line of Defense​

A firewall is a security device or software that monitors and controls incoming and outgoing network traffic based on predefined rules. Firewalls help enforce network segmentation by restricting communication between different segments.

Types of Firewalls​

1. Packet-Filtering Firewalls (Stateless Firewalls)​

  • Examines individual packets based on source/destination IP addresses and ports.
  • Example: Blocks all traffic except HTTP (port 80) and HTTPS (port 443) for a web server.
  • Limitation: Does not track the state of connections, making it less effective against complex attacks.

2. Stateful Inspection Firewalls​

  • Tracks the state of active connections and ensures that only valid packets are allowed.
  • Example: If a user initiates a request to a website, only the expected response traffic is allowed back in.

3. Proxy Firewalls​

  • Acts as an intermediary between users and the internet, inspecting all traffic before forwarding it.
  • Example: A company might use a proxy firewall to filter and inspect all employee web traffic.

4. Next-Generation Firewalls (NGFWs)​

  • Combines traditional firewall capabilities with intrusion prevention systems (IPS), deep packet inspection (DPI), and application-layer filtering.
  • Example: A financial institution uses an NGFW to block malware and detect suspicious behavior in real-time.

5. Cloud-Based Firewalls (Firewall-as-a-Service, FWaaS)​

  • Deployed in cloud environments to secure cloud-based applications and workloads.
  • Example: A business using AWS or Azure implements a cloud-based firewall to protect cloud servers.

How Firewalls and Network Segmentation Work Together​

Firewalls act as gatekeepers that enforce security rules between different network segments.

Example: A Segmented Corporate Network with Firewalls​

A bank’s network may have the following segments:

  • Internal Network (Employees): Access to internal systems only.
  • ATM Network: Completely isolated from internal banking systems.
  • Guest Wi-Fi: Cannot access the corporate network.

Firewall Rules:​

  • Allow internal users to access banking applications but block guest network users.
  • Prevent ATM systems from directly communicating with employee workstations.
  • Allow only secure connections (HTTPS, VPN) for remote banking transactions.

Without these security measures, an attacker compromising the guest Wi-Fi might gain access to critical banking infrastructure.

Best Practices for Network Segmentation and Firewall Implementation​

1. Follow the Principle of Least Privilege (PoLP)​

  • Only grant users and devices access to what they absolutely need.
  • Example: A marketing employee does not need access to HR payroll databases.

2. Implement Strong Firewall Policies​

  • Block all unnecessary ports and allow only trusted traffic.
  • Example: If a company only needs SSH (port 22) and HTTPS (port 443) open, block all other ports.

3. Use VLANs for Logical Segmentation​

  • Create separate VLANs for different departments or device types.
  • Example: In a retail store, POS systems should be on a different VLAN than employee devices.

4. Deploy an Intrusion Detection and Prevention System (IDPS)​

  • Monitors network traffic for suspicious activity and alerts administrators.

5. Regularly Update Firewall Rules and Monitor Logs​

  • Outdated firewall configurations can create vulnerabilities.
  • Example: A company regularly reviews firewall logs to detect unauthorized access attempts.

Key Takeaways​

  • Network segmentation divides a network into isolated segments to improve security, reduce attack surfaces, and limit lateral movement.
  • Firewalls act as a security barrier, monitoring and controlling network traffic between different segments.
  • Different types of firewalls (packet-filtering, stateful, NGFW, cloud-based) offer various levels of security.
  • Combining segmentation with firewalls ensures strict access controls and prevents unauthorized communication.
  • Implementing VLANs, strong firewall rules, and intrusion detection systems enhances network security.
© 2025 Neplearn