Firewalls and segmentation

When a ship has a hole in the hull, watertight compartments stop the whole ship filling with water. Networks have the same idea. Assume one machine will eventually be compromised; the question is how much else it can reach. A firewall is the tool for making that answer "very little".

What a firewall does

A firewall is software or hardware that looks at each network connection and applies a list of rules to decide whether it may pass. The rules look at facts you already know from earlier lessons: the source and destination IP address, the port, and the direction.

A rule list is read from top to bottom and the first match wins:

Rule 1 lets the world load the website. Rule 2 lets only the office reach the admin door (port 22 is SSH, remote login). Rule 3 refuses everything else. If rule 3 were missing, whether the unlisted traffic gets through would depend on the firewall's default.

Default deny

That default is the most important setting in the whole device.

• Default allow: everything passes except what you have listed. You must anticipate every bad thing in advance. You cannot.
• Default deny: everything is blocked except what you listed. A forgotten case fails closed.

This is least privilege applied to networks. Each open port is part of your attack surface, so you open the few you can justify and let the default close the rest. The unwelcome side effect is that default deny breaks things on day one, and someone adds an "allow any" rule to fix it. Watch for rules that quietly undo the default, such as allow any from anywhere to anywhere.

Firewalls live in more than one place

• Network firewall: a device or cloud rule set between networks, such as between the internet and your servers.
• Host firewall: software on the machine itself, which still protects it if the network around it is hostile.
• Cloud security groups: the same idea as a rule list, attached to cloud machines.

Using several layers is deliberate. A rule that is wrong in one place is still caught by the other.

There is also a quieter control than any firewall: a program that listens only on 127.0.0.1 (the machine itself) cannot be reached from another computer at all. You will test that below.

Inbound and outbound

Most beginners think only about inbound traffic: keeping outsiders from connecting in. Outbound (also called egress) filtering is the other half.

Once malware or a misbehaving program is running on a machine, it usually has to talk to something: to fetch more tools, to receive instructions, or to send stolen data out. If the machine may only reach a short list of destinations, all of that becomes much harder. Egress filtering rarely stops the initial break-in, but it cuts what the intruder can do next. The servers in a database tier, for example, usually have no reason to start connections to the open internet.

Segmentation

Network segmentation divides a network into zones and uses firewall rules between them so that traffic crosses only where it must.

A small company might have four zones: the public web servers, the application servers, the database, and the office laptops. The allowed paths are then specific:

• internet to web servers: port 443 only;
• web servers to application servers: one port;
• application servers to database: one port;
• everything else between zones: denied.

Now imagine the web server is compromised through a bug in the website. In a flat network, where every machine can talk to every other, the intruder can try the databases, the file shares and the laptops. In a segmented one, the web server can reach only the application tier on one port. The same bug causes a much smaller incident. This is what people mean by limiting the blast radius.

Segmentation also helps defenders see. If the database should only ever hear from the application servers, then any other source contacting it is suspicious by definition, which is a very clean thing to alert on. The next lessons build on exactly that.

What a firewall cannot do

A firewall sees addresses and ports, usually not meaning. If you allow port 443 to your web server, a malicious request on port 443 passes like any other, so a flaw such as SQL injection still works. And if an attacker steals a valid login, the firewall sees an allowed user. Firewalls shrink the area an attacker can walk across. They do not remove the bugs in the doors you leave open, so they sit beside patching, not instead of it.

How AI changes this

Attackers. Automated scanning for open ports and exposed services has existed for decades; AI makes it cheaper to adapt, for example by choosing what to try against each service it finds. The defence is unchanged but its value rises: a port that is not reachable cannot be probed. Anthropic's red team research on self-replicating AI, covered in our write-up, says a simplified test spread over an unauthenticated debug port, and its practical advice is to expose no such services and put cheap IoT devices on a separate segment with restricted outbound traffic. That is this lesson, in one sentence.

Defenders. Rule lists grow messy over years, and reviewing which rules are still used is tedious work that assistants can help summarise. The decision to remove a rule should stay with a person who knows what depends on it.

Agents as a new actor. A coding agent runs on your machine and can usually reach whatever your machine can, including the internet. That makes outbound control the relevant layer. A benchmark called SWE-Together changed its sandbox to enforce default-deny egress through an allowlisting proxy after an agent kept reaching for outside code; our post on it reports that enforcement moved outside the containers and blocked thousands of attempts, which is a useful lesson: if an agent can edit the rules, they are advice, not a boundary. Beam's scanner and policies work at the agent-action level rather than as a network firewall, so they complement network controls rather than replace them.

Try it

This lab uses only your own machine and a scratch folder. It shows why "listening only on yourself" is itself a boundary.

Start a tiny web server that listens only on the loopback address:

mkdir ~/fw-lab && cd ~/fw-lab && echo hello > index.html
python3 -m http.server 8080 --bind 127.0.0.1

In a second terminal, see what is listening and on which address:

lsof -nP -iTCP:8080 -sTCP:LISTEN
curl -s http://127.0.0.1:8080/

The address column should read 127.0.0.1:8080. Only programs on this computer can reach it. Stop the server with Ctrl+C and restart it bound to everything:

python3 -m http.server 8080 --bind 0.0.0.0

Run the lsof command again: the address is now *:8080, meaning every network interface. Whether other computers can actually connect now depends on your host firewall, which is the point of having one. Stop the server with Ctrl+C and remove the folder with cd ~ && rm -r ~/fw-lab.

Check yourself

Next

Segmentation fails if a threat can hop between zones on its own. The next lesson looks at worms and lateral movement, and how one machine becomes ten thousand.