[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 3 · 3.4.c
AP Cybersecurity · Securing Networks
Effective Firewall Placement
One firewall per boundary — and each gets the strictness its contents deserve.
key ideaOne firewall per boundary — and each boundary gets the strictness its contents deserve.
Matching controls to threats
A firewall only filters traffic that passes through it. That single fact settles placement: put one wherever traffic crosses from one trust level to another, and anywhere it does not cross a firewall is unfiltered by definition.
| Boundary | Why a firewall belongs here | Consequence of omitting it |
|---|
| every point of ingress and egress to the internet | all external traffic is filtered | one unfiltered path defeats the others |
| between the DMZ and the internal network | a compromised public service is contained | a web-server breach becomes a network breach |
| between segments | each segment controls what enters and leaves it | lateral movement is unfiltered and invisible |
| around a high-security zone | the strictest rules apply only where needed | the strictest rules would have to apply everywhere |
Row 1 says every point, not the main one. A second internet connection installed for a project, with no firewall, bypasses the entire edge design.
Layering
Every internet edgeingress and egress both
Every segmentin and out of that segment
Every zonestrictness set independently
[Figure: The same estate with the firewalls drawn in. Traffic from the internet crosses one before the public servers and another before the internal network — each set independently.]
The same estate with the firewalls drawn in. Traffic from the internet crosses one before the public servers and another before the internal network — each set independently.| Segment | What is in it | Firewall strictness |
|---|
| guest Wi-Fi | visitor devices | internet only; no route inward |
| general office | staff workstations | outbound broad, inbound narrow |
| DMZ | public web and mail services | inbound narrow; outbound to internal denied by default |
| finance | regulated financial data | explicit permits only, in both directions |
| industrial control | equipment that must not be reachable | near-total isolation; a short allow-list |
Independent strictness is the point. A single firewall serving all five would be as permissive as its most permissive tenant — which is how flat networks end up with weak rules everywhere.
Ingress / egressTraffic entering and leaving. Every such point to the internet needs a firewall.
Screened subnetThe segment between external and internal networks. It needs a firewall on both sides.
Segment firewallControls the flow of data in and out of one segment — the only thing that filters lateral movement.
Independent levelsEach firewall's strictness is set for what it protects, not for the network as a whole.
the four placement rules
- Each segment of a network should have a firewall controlling data in and out of that segment.
- Segments have different security needs based on the data and services within them.
- The level of security for each firewall can be set independently.
- Every point of ingress and egress between the internal network and the internet needs one.
Worked analysis
EX 1
The second internet connection
A branch office installs its own broadband link for a video project, connected to the same internal network but not through the corporate firewall. Assess.
1
Identify what was created
A second point of ingress and egress to the public internet.
2
Apply the rule
Each such point requires a firewall.
3
State the consequence
External traffic can reach the internal network without passing any filter.
4
Note what it does to the main firewall
It is now bypassable — its rules protect only one of two paths.
5
Give the fix
Firewall the second link, or route it through the existing edge. An unfiltered path makes the filtered one decorative.
EX 2
Why segment firewalls differ
A hospital's guest Wi-Fi and its clinical network both sit behind the same edge firewall. Why add more?
1
Note what the edge firewall does
It filters internet traffic only.
2
Ask what it sees between the two segments
Nothing — internal traffic never crosses it.
3
State the exposure
A compromised guest device can reach clinical systems unfiltered.
4
Apply the rule
Each segment should have a firewall controlling flow in and out.
5
Set the levels independently
Guest: internet only. Clinical: explicit permits. Two firewalls, two policies, one design.
EX 3
Placing the DMZ firewall
A public web server sits in a DMZ. Where do the firewalls go, and what does each enforce?
1
Place the outer firewall
Between the internet and the DMZ — permit HTTPS to the web server, deny the rest.
2
Place the inner firewall
Between the DMZ and the internal network.
3
Write the inner rule
Deny DMZ → internal by default, with named exceptions for the traffic the service genuinely needs.
4
State what this buys
A compromised web server yields the DMZ and not the network behind it.
5
Note the failure without it
One firewall at the edge would leave the web server on the same footing as a workstation once compromised.
Check yourself
Where should firewalls be placed relative to network segments?
Show answer
Each segment of a network should have a firewall to control the flow of data in and out of that segment.
Why can the level of security differ between firewalls?
Show answer
Segments have different security needs based on the data and services within them, and the level for each firewall can be set independently — so a strict zone does not force strictness everywhere.
How many firewalls does the internet boundary need?
Show answer
One at every point of ingress and egress between the internal network and the public internet. A single unfiltered path bypasses all the others.
Why is an edge firewall alone insufficient?
Show answer
It only filters traffic that crosses it. Traffic between internal segments never does, so lateral movement is unfiltered and unlogged.