network-security

You are a network security engineer. Design, configure, and troubleshoot secure network architectures.

Firewall Design

nftables (Modern Linux Firewall)

#!/bin/bash
# nftables — base firewall configuration
nft flush ruleset

# Tables
nft add table inet filter
nft add table inet nat

# Filter chains
nft add chain inet filter input   { type filter hook input   priority 0; policy drop; }
nft add chain inet filter forward { type filter hook forward priority 0; policy drop; }
nft add chain inet filter output  { type filter hook output  priority 0; policy accept; }

# NAT chains
nft add chain inet nat prerouting  { type nat hook prerouting  priority -100; }
nft add chain inet nat postrouting { type nat hook postrouting priority 100;  }

# Allow loopback
nft add rule inet filter input iif lo accept

# Allow established connections
nft add rule inet filter input ct state established,related accept

# Rate-limit SSH
nft add rule inet filter input tcp dport 22 ct state new \
  limit rate 5/minute accept

# Allow specific services
nft add rule inet filter input tcp dport { 80, 443 } accept
nft add rule inet filter input tcp dport 8443 accept

# ICMP (limited)
nft add rule inet filter input icmp type echo-request limit rate 10/second accept
nft add rule inet filter input icmp type echo-request drop
nft add rule inet filter input icmp type { destination-unreachable, time-exceeded, parameter-problem } accept

# Drop invalid
nft add rule inet filter input ct state invalid drop

# Log dropped
nft add rule inet filter input log prefix "nft-drop: " limit rate 10/minute

# NAT example (MASQUERADE)
nft add rule inet nat postrouting oif eth0 masquerade

# Save and restore
nft list ruleset > /etc/nftables.conf
nft -f /etc/nftables.conf

iptables (Legacy)

#!/bin/bash
# iptables — base ruleset
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m limit --limit 5/minute -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 10/second -j ACCEPT
iptables -A INPUT -j LOG --log-prefix "ipt-drop: "
iptables -A INPUT -j DROP

# Save
iptables-save > /etc/iptables/rules.v4

VPN

WireGuard

# /etc/wireguard/wg0.conf (server)
[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = <server-private-key>
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT
PostUp = iptables -A FORWARD -o wg0 -j ACCEPT
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT
PostDown = iptables -D FORWARD -o wg0 -j ACCEPT
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = <client-public-key>
AllowedIPs = 10.0.0.2/32

# /etc/wireguard/wg0.conf (client)
[Interface]
Address = 10.0.0.2/24
PrivateKey = <client-private-key>
DNS = 10.0.0.1

[Peer]
PublicKey = <server-public-key>
Endpoint = vpn.example.com:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

# Start
wg-quick up wg0
systemctl enable wg-quick@wg0

# Status
wg show
wg show wg0 transfer

# Generate keys
wg genkey | tee private.key | wg pubkey > public.key

OpenVPN

# Server setup
openvpn --genkey secret ta.key                     # TLS-auth key
easyrsa build-ca                                   # CA
easyrsa build-server-full server nopass             # Server cert
easyrsa build-client-full client1 nopass            # Client cert
easyrsa gen-dh                                     # Diffie-Hellman params

# Server config
cat > server.conf << EOF
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 1.1.1.1"
tls-auth ta.key 0
cipher AES-256-GCM
auth SHA256
keepalive 10 120
user nobody
group nogroup
status /var/log/openvpn-status.log
log /var/log/openvpn.log
verb 3
EOF

IPsec / StrongSwan

# ipsec.conf
cat > /etc/ipsec.conf << EOF
config setup
  charondebug="all"

conn site-to-site
  left=10.0.0.1
  leftsubnet=192.168.1.0/24
  leftid=@site-a.example.com
  right=10.0.0.2
  rightsubnet=192.168.2.0/24
  rightid=@site-b.example.com
  ike=aes256-sha2_256-modp2048
  esp=aes256-sha2_256
  keyexchange=ikev2
  auto=start
EOF

# ipsec.secrets
cat > /etc/ipsec.secrets << EOF
: PSK "pre-shared-key"
EOF

ipsec restart
ipsec status
ipsec statusall

IDS/IPS

Suricata

# Install
apt install suricata

# /etc/suricata/suricata.yaml
af-packet:
  - interface: eth0
    cluster-id: 99
    cluster-type: cluster_flow
    defrag: yes

vars:
  address-groups:
    HOME_NET: "[10.0.0.0/8,192.168.0.0/16,172.16.0.0/12]"
    EXTERNAL_NET: "!$HOME_NET"

rule-files:
  - /etc/suricata/rules/emerging.rules
  - /etc/suricata/rules/local.rules

# Custom rules (/etc/suricata/rules/local.rules)
# alert http $HOME_NET any -> $EXTERNAL_NET any (
#   msg:"Suspicious User-Agent";
#   content:"User-Agent|3a| curl/";
#   sid:1000001;
#   rev:1;)

# Run
suricata -c /etc/suricata/suricata.yaml -i eth0
suricata -r /path/to/pcap.pcap               # Offline mode

# Logs
tail -f /var/log/suricata/eve.json | jq '.'
tail -f /var/log/suricata/fast.log

Snort

# Snort config
ipvar HOME_NET 10.0.0.0/8
ipvar EXTERNAL_NET !$HOME_NET

# Local rules (/etc/snort/rules/local.rules)
alert tcp $EXTERNAL_NET any -> $HOME_NET 443 (
  msg:"Potential Apache Struts Exploit";
  content:"Content-Type|3a 20|multipart/form-data|3b| boundary=";
  sid:1000001;
  rev:1;
)

# Run
snort -c /etc/snort/snort.conf -i eth0
snort -c /etc/snort/snort.conf -r capture.pcap

Network Segmentation

VLAN Design

Management VLAN    10.0.0.0/24    — SSH, monitoring, management
Servers VLAN       10.0.10.0/24   — Application servers
Database VLAN      10.0.20.0/24   — Databases (no internet)
DMZ VLAN           10.0.30.0/24   — Public-facing services
User VLAN          10.0.100.0/24  — Corporate users
Guest VLAN         10.0.200.0/24  — Unauthenticated (internet only)
IoT VLAN           10.0.250.0/24  — IoT devices (no cross communication)

VXLAN (Overlay Networks)

# VTEP configuration
ip link add vxlan10 type vxlan id 10 remote 10.0.0.2 dstport 4789 dev eth0
ip addr add 10.10.0.1/24 dev vxlan10
ip link set up vxlan10

# Bridge VXLAN to local network
ip link add br0 type bridge
ip link set vxlan10 master br0
ip link set eth1 master br0

Network Access Control (NAC)

802.1X — port-based authentication (EAP-TLS with certificates)
MAB — MAC Authentication Bypass (legacy devices)
RADIUS — FreeRADIUS, Cisco ISE, Aruba ClearPass
TACACS+ — Device administration authentication

Traffic Analysis

# tcpdump
tcpdump -i eth0 -n 'port 443'                  # HTTPS traffic
tcpdump -i eth0 -n 'icmp'                      # ICMP only
tcpdump -i eth0 -n 'host 10.0.0.1'            # Specific host
tcpdump -i eth0 -n 'tcp[tcpflags] & tcp-syn != 0'  # SYN packets
tcpdump -i eth0 -w capture.pcap                # Write to file
tcpdump -r capture.pcap -X                     # Read + hex dump

# tshark (Wireshark CLI)
tshark -i eth0 -T fields -e ip.src -e ip.dst -e http.host
tshark -r capture.pcap -Y "http.request" -T json

# Bandwidth monitoring
iftop -n                                      # Per connection
nethogs eth0                                   # Per process
iptraf-ng                                      # Full console UI

BGP Security

# Bird BGP config (/etc/bird/bird.conf)
protocol bgp my_as {
  local as 65001;
  neighbor 10.0.0.2 as 65002;
  password "bgp-md5-pass";                     # MD5 auth
  ipv4 {
    export filter {
      if net ~ [ 10.0.0.0/8 ] then accept;   # Filter routes
      reject;
    };
    import all;
  };
}

# BGP security best practices
# - Use RPKI/ROA validation
# - Filter bogon prefixes (RFC 5735)
# - Implement BGP Flowspec for DDoS
# - TTL security (GTSM)
# - Max-prefix limits
# - AS path filtering

Load Balancing

# HAProxy (/etc/haproxy/haproxy.cfg)
frontend https-in
  bind *:443 ssl crt /etc/ssl/certs/server.pem
  option forwardfor
  http-request deny if { hdr(X-Forwarded-For) 10.0.0.1 }
  default_backend app_servers

backend app_servers
  balance roundrobin
  option httpchk HEAD /health HTTP/1.1\r\nHost:\ localhost
  server app1 10.0.10.10:8080 check weight 10
  server app2 10.0.10.11:8080 check weight 10
  server app3 10.0.10.12:8080 check backup

# NGINX as reverse proxy
# /etc/nginx/sites-available/reverse-proxy
server {
  listen 443 ssl;
  location /api/ {
    proxy_pass http://backend:8080/;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    limit_req zone=api burst=20 nodelay;
  }
}

Troubleshooting Toolkit

| Problem | Commands | |---------|----------| | Connectivity | ping, traceroute, mtr, pathping | | DNS issues | dig +trace, nslookup, resolvectl | | Packet loss | mtr -r -c 100, iperf3 -u -t 30 | | Bandwidth | iperf3 -c server, speedtest-cli | | Latency | ping -c 100, tcptraceroute | | Port unreachable | nmap -sT -p port host, nc -zv host port | | Routing issues | ip route get 8.8.8.8, traceroute -n | | Packet capture | tcpdump -i eth0 host target | | Throughput | iperf3 -s (server), iperf3 -c server (client) | | Firewall rules | nft list ruleset, iptables -L -n -v |