Routing and Network Devices: Switch, Router, Firewall

You now know how addresses, names and ports work. One question remains: how does a packet leave your home and cross the world to reach a server? The answer involves a small set of devices that every security professional must be able to picture instantly. By the end of this lesson you will know what a switch, a router and a firewall each do, and where an attacker or a defender can act on each.

In lesson 1 we said that two machines can talk directly only if they share the same network part of their address. This lesson explains what happens when they do not.

Inside one network: the switch

A switch connects devices inside the same local network (a LAN). It works at the link layer, and it reasons with MAC addresses, the hardware identifiers burned into network cards (for example 3c:22:fb:12:34:56). A switch keeps a table that remembers which MAC address was seen on which physical port. When a frame arrives, the switch looks up the destination MAC and forwards it only to the right port. If the destination is unknown, it sends the frame out of all ports, as a temporary measure.

The older hub simply repeated everything to everybody. Because a switch forwards selectively, it limits what a machine can overhear, which is a security improvement, although not a complete one, as chapter 2 will show.

Between networks: the router

A router connects different networks and works at the internet layer, using IP addresses. Your home box is a router: one side faces your private network, the other faces your provider. When a computer wants to send a packet, it first compares the destination with its own network:

• If the destination is in the same network, it sends the packet directly to the destination.
• If not, it sends the packet to its default gateway, the router, which will deal with it.

A router uses a routing table: a list of rules saying "for destination networks like this, send the packet to that next hop". Each router on the way only knows the next step, not the whole path. Every router decrements a counter in the packet called TTL (time to live, a different concept from the DNS TTL), and drops the packet when it reaches zero. This prevents packets from looping forever.

You can see the table of your own machine:

# Linux
ip route

# macOS
netstat -rn

# Windows
route print

The line labelled default (or 0.0.0.0/0) is the default route: "if nothing more specific matches, go through the gateway".

Following the path

The TTL mechanism gives us a neat diagnostic tool. traceroute (Linux, macOS) or tracert (Windows) sends packets with a TTL of 1, then 2, then 3, and so on. Each router that discards a packet reports itself, so you obtain the list of hops. A basic connectivity test uses ping, which sends ICMP "echo request" messages and waits for "echo reply" messages.

ping -c 4 192.168.1.1
traceroute example.com

Some routers do not answer these probes, so a line of stars in the output does not always mean a failure. Only run these tools against your own equipment or against harmless, public documentation names such as example.com, and remember that some networks consider repeated probing hostile.

Controlling the traffic: the firewall

A firewall decides which traffic is allowed to pass, according to rules. Its simplest form is a packet filter: it examines addresses, ports and protocols and applies rules such as "allow TCP to port 443, deny everything else". A stateful firewall goes further: it remembers established connections, so it can allow replies to connections that you started while blocking unsolicited incoming connections. Modern next-generation firewalls and web application firewalls inspect traffic at the application level as well.

Two principles guide good firewall rules:

• Default deny: block everything, then allow precisely what is needed.
• Least privilege: allow only the sources, destinations and ports a service truly requires.

Firewalls exist at several levels. The "personal firewall" of your operating system protects one machine. A network firewall protects a whole segment. Cloud providers also offer virtual firewalls called security groups. They all rely on the same logic.

Other devices you will meet

• Access point: lets Wi-Fi devices join a wired network.
• Modem: converts between your provider's medium and a standard network signal. At home, it is often combined with the router.
• Load balancer: spreads requests across several servers.
• Proxy: an intermediary that makes requests on behalf of clients. Later in the track you will use an intercepting proxy to inspect your own web traffic.
• IDS / IPS: intrusion detection and prevention systems, which look for suspicious patterns in traffic.

The classic architecture: LAN, DMZ and the Internet

Companies rarely put everything on one flat network. A common design has three zones: the Internet (untrusted), a DMZ (demilitarised zone) where public-facing servers such as the web server live, and the internal LAN with workstations and sensitive systems. Firewalls sit between the zones: the Internet may reach the DMZ on specific ports, the DMZ may only reach the LAN for narrow, necessary flows, and the LAN may go out to the Internet. The idea is containment: if the public web server is compromised, the attacker is still not inside the internal network. Your own lab will reproduce a miniature version of this design.

Your turn: draw your home network

On a sheet of paper, draw the devices of your home or office network: the box, your computer, your phone, any other connected object. For each one, write its IP address if you can find it. Mark where the switch function, the router function and the firewall function are located (for many people, all three are inside the same box). Then answer: if a connected camera is compromised, what could it reach, and what single change would reduce the risk?

See a solution

In a typical home, the provider box combines the router (it connects your private network to the Internet and performs NAT), the switch (its Ethernet ports and the Wi-Fi access point share one local network) and a basic stateful firewall (it blocks unsolicited incoming connections). A compromised camera sits on the same flat network as your computers, so in principle it could try to reach them. A good improvement is to put such objects on a separate network, which many routers offer under the name "guest network" or "IoT network", and to change their default passwords and update their firmware. This is the same idea as a DMZ, applied at home, and it leads directly to the VLANs of chapter 2.