W Code - Pattern-Based DSA Learning Platform

Bhanu Bisht

Network Security Architecture

Firewalls, VPN Tunnels, Cryptography, MitM Prevention & IDS/IPS

Network Security: Enforces rules, protocols, and encryption primitives designed to defend network infrastructure from unauthorized access, exploitation, and data tampering.

The CIA Triad — Core Security Pillars

Confidentiality

Ensures payload secrecy via strong encryption (AES-256, TLS 1.3).

Integrity

Guarantees data is unaltered using cryptographic hashes (SHA-256).

Availability

Maintains system uptime against DDoS and infrastructure outages.

Firewalls & Access Control Lists

Perimeter Security & Traffic Filtering

A Firewall acts as an access control boundary inspecting packets crossing network perimeters.

Firewall Architectural Classes:

Packet Filter (L3/L4): Inspects IP headers and TCP/UDP ports against static Access Control Lists (ACLs).
Stateful Inspection (L4): Tracks active connection states (SYN_SENT, ESTABLISHED), allowing bidirectional response flows automatically.
Next-Generation Firewall (NGFW - L7): Performs Deep Packet Inspection (DPI) to enforce application identity controls (e.g., allow Slack, block Torrent).

Firewalls & Access Control Lists — Architecture & Configuration

// Linux IPTables Stateful Firewall Rule Example
# Allow active established connection replies
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow inbound SSH on Port 22 from Admin Subnet only
iptables -A INPUT -p tcp -s 192.168.1.0/24 --dport 22 -j ACCEPT

# Allow inbound HTTPS web traffic
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Drop all remaining unsolicited inbound packets
iptables -A INPUT -j DROP

Virtual Private Networks (VPN)

Encrypted Tunneling over Public Infrastructure

A VPN establishes an encrypted, private overlay tunnel across untrusted public networks (the Internet), preserving confidentiality and data integrity.

VPN Protocols & Standards:

IPSec (IP Security - Network Layer): Provides authentication (AH) and encryption (ESP) at Layer 3. Operates in Tunnel Mode (full IP payload header encrypted) or Transport Mode.
WireGuard: Modern, high-performance VPN leveraging Noise protocol framework and ChaCha20-Poly1305 encryption.
SSL / TLS VPN: Browser-based clientless secure access (HTTPS Port 443).

Virtual Private Networks (VPN) — Architecture & Configuration

// WireGuard Lightweight VPN Configuration
[Interface]
PrivateKey = uG8fK2xL... (Client Node Private Key)
Address = 10.8.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = 7xK3mN... (VPN Gateway Public Key)
Endpoint = vpn.wcode.edu:51820
AllowedIPs = 0.0.0.0/0  (Full Tunnel Routing)

Encryption & Cryptography

Fundamental Cryptographic Primitives

Cryptography safeguards information confidentiality, authenticity, and non-repudiation across digital channels.

Core Cryptographic Categories:

Symmetric Encryption (AES-256, ChaCha20): Single shared secret key used for high-speed encryption and decryption.
Asymmetric Encryption (RSA-4096, ECC / Ed25519): Public key encrypts data / verifies signatures; private key decrypts / signs.
Cryptographic Hashing (SHA-256, BLAKE2): One-way mathematical digest enforcing data integrity verification.

Encryption & Cryptography — Architecture & Configuration

// TLS 1.3 Asymmetric & Symmetric Hybrid Cryptography
1. Client & Server exchange Public Keys via Elliptic-Curve Diffie-Hellman (ECDHE).
2. Derives temporary Ephemeral Session Key (Symmetric AES-GCM).
3. All subsequent Application Data encrypted using fast AES-256-GCM.

Network Threat Vectors & Attacks

Identifying & Mitigating Common Network Vulnerabilities

Understanding modern network exploitation vectors is essential for engineering resilient network infrastructure.

Threat Categories:

Distributed Denial of Service (DDoS): Flooding targets with SYN floods, UDP amplification, or HTTP GET floods to exhaust connection pools.
Man-in-the-Middle (MitM): Intercepting network traffic via ARP Poisoning, DNS Spoofing, or Rogue Access Points.
IP / MAC Spoofing: Forging packet header source addresses to bypass firewall ACL checks.

Network Threat Vectors & Attacks — Architecture & Configuration

# ARP Cache Poisoning Attack & MitM Mechanism
Attacker sends gratuitous ARP replies to Victim IP 192.168.1.10:
"192.168.1.1 (Gateway IP) is at MAC AA:BB:CC:66:66:66 (Attacker MAC)"

Mitigation: Dynamic ARP Inspection (DAI) on Layer-2 Switches + IP-MAC Binding Tables.

IDS vs IPS (Intrusion Systems)

Real-Time Threat Detection & Automated Prevention

Intrusion Detection Systems (IDS) passively inspect network traffic copies (via SPAN ports), raising alerts when malicious signatures trigger. Intrusion Prevention Systems (IPS) sit inline in the active data path, dropping malicious packets in real-time.

Detection Engines:

Signature-Based: Compares payload byte sequences against known vulnerability databases (e.g., CVE signatures).
Anomaly-Based: Evaluates statistical deviations from baseline normal network behavior via Machine Learning models.

IDS vs IPS (Intrusion Systems) — Architecture & Configuration

// Snort / Suricata IDS Signature Rule Example
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (
  msg:"ET EXPLOIT SQL Injection Attack Attempt";
  content:"UNION SELECT"; nocase;
  sid:2010042; rev:5;
)

AAA & Port Authentication (802.1X)

Authentication, Authorization & Accounting (AAA)

Enterprise network security demands strict verification of identity before granting access to network ports or resources.

Key Frameworks:

802.1X Port Security: Enforces EAP (Extensible Authentication Protocol) challenges at the physical switch port before granting network access.
RADIUS / TACACS+: Centralized backend authentication servers validating user credentials and accounting logs.

AAA & Port Authentication (802.1X) — Architecture & Configuration

// 802.1X Supplicant Handshake Architecture
Client Device (Supplicant) ──[EAPoL]──> Switch Port (Authenticator) ──[RADIUS]──> RADIUS Server

🎯 Key Interview Concepts — Network Security

Stateful vs Packet Filtering Firewalls: Stateful tracks connection states (SYN/ESTABLISHED); Packet filtering evaluates static header fields.

IDS vs IPS: IDS passively monitors SPAN traffic (out-of-band); IPS sits inline in the active traffic path to block threats automatically.

Symmetric vs Asymmetric Encryption: Symmetric uses 1 key for fast bulk payload encryption; Asymmetric uses public/private keys for handshake authentication and key exchange.

// Linux IPTables Stateful Firewall Rule Example # Allow active established connection replies iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # Allow inbound SSH on Port 22 from Admin Subnet only iptables -A INPUT -p tcp -s 192.168.1.0/24 --dport 22 -j ACCEPT # Allow inbound HTTPS web traffic iptables -A INPUT -p tcp --dport 443 -j ACCEPT # Drop all remaining unsolicited inbound packets iptables -A INPUT -j DROP

// WireGuard Lightweight VPN Configuration [Interface] PrivateKey = uG8fK2xL... (Client Node Private Key) Address = 10.8.0.2/24 DNS = 1.1.1.1 [Peer] PublicKey = 7xK3mN... (VPN Gateway Public Key) Endpoint = vpn.wcode.edu:51820 AllowedIPs = 0.0.0.0/0 (Full Tunnel Routing)

// TLS 1.3 Asymmetric & Symmetric Hybrid Cryptography 1. Client & Server exchange Public Keys via Elliptic-Curve Diffie-Hellman (ECDHE). 2. Derives temporary Ephemeral Session Key (Symmetric AES-GCM). 3. All subsequent Application Data encrypted using fast AES-256-GCM.

# ARP Cache Poisoning Attack & MitM Mechanism Attacker sends gratuitous ARP replies to Victim IP 192.168.1.10: "192.168.1.1 (Gateway IP) is at MAC AA:BB:CC:66:66:66 (Attacker MAC)" Mitigation: Dynamic ARP Inspection (DAI) on Layer-2 Switches + IP-MAC Binding Tables.

🎯 Key Interview Concepts — Network Security

Stateful vs Packet Filtering Firewalls: Stateful tracks connection states (SYN/ESTABLISHED); Packet filtering evaluates static header fields.

IDS vs IPS: IDS passively monitors SPAN traffic (out-of-band); IPS sits inline in the active traffic path to block threats automatically.

Symmetric vs Asymmetric Encryption: Symmetric uses 1 key for fast bulk payload encryption; Asymmetric uses public/private keys for handshake authentication and key exchange.