◇ OpenCyber Academy
Technologist · Chapter 2 · English

Chapter 2 — Networks and internet services

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Networks and internet services

Lesson map

Lesson 02 published. Map, example, EX004.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Addresses and subnets"]
  N2["2.2 VLANs and firewalls"]
  N3["2.3 Outbound cloud connections"]
  N4["2.4 Name resolution"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX004"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Addresses and subnets"]
  N2["2.2 VLANs and firewalls"]
  N3["2.3 Outbound cloud connections"]
  N4["2.4 Name resolution"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX004"]

[Learning outcomes]
    |
    v
[2.1 Addresses and subnets]
    |
    v
[2.2 VLANs and firewalls]
    |
    v
[2.3 Outbound cloud connections]
    |
    v
[2.4 Name resolution]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX004]

Learning outcomes

You will (1) read an IP address plan and identify subnets; (2) explain what a VLAN and a firewall rule do; (3) trace how a cloud-connected logger reaches the internet; and (4) recognise the services a facility exposes outward.

2.1 Addresses and subnets

NCS uses 10.10.0.0/24 for offices, 10.20.0.0/24 for refrigeration control and 10.30.0.0/24 for loggers and cameras. A /24 mask means the first three numbers name the network and the last names the host. Two devices on the same subnet talk directly through the switch; devices on different subnets must pass a router or firewall, which is where policy can be applied.

Priya's trace of a logger reading shows the boundaries in use: the logger reports to GW-LOG at 10.30.0.5, and firewall rule 21 lets 10.30.0.5 reach the vendor cloud on TCP 443. The same firewall holds rule 9, "any to 10.20.0.0/24, TCP 502, allow", which lets every office address reach the refrigeration controllers' Modbus port.

2.2 VLANs and firewalls

A VLAN separates traffic logically on shared switches. VLANs alone do not filter: the filtering happens where traffic is routed between them. A firewall rule names source, destination, protocol and port, and whether to allow or deny. A sound default is "deny everything not explicitly allowed".

Rule 9 is the NCS example of a rule that defeats the default. It was added at commissioning so the contractor could work from any port, and nobody removed it. With rule 9 in place, the VLANs still separate broadcast traffic, but the firewall between 10.10.0.0/24 and 10.20.0.0/24 allows exactly the flow that matters most: Modbus from the office to PLC-R1 and PLC-R2. Priya's later lab finds OFFICE-7 using it.

2.3 Outbound cloud connections

GW-LOG opens an outbound HTTPS connection (TCP 443) to the logger vendor's cloud. Outbound connections are easier to secure than inbound ones because nobody on the internet can start a session to the gateway — provided the firewall does not also forward an inbound port to it. Remote-support tools often add exactly that forwarding, which is how many devices become internet-facing.

At NCS, rule 21 is outbound only; Priya checked that no port-forward to 10.30.0.5 exists, and recorded that check, so the claim can be re-verified after the next vendor visit.

2.4 Name resolution

The gateway finds the cloud by DNS. If the gateway uses an internal DNS server, a misconfiguration there can break logging plant-wide; if it uses a public resolver directly, the firewall must permit that too. Write down which.

For GW-LOG, Priya found it used the site's internal DNS server, so the rule set needed no public-resolver exception. That has a consequence for the certificate failures in Chapter 22: when LOG-03 stopped uploading on 5 October, DNS was one of the dependencies to rule out before blaming the expired certificate. A one-line note in the inventory, "GW-LOG resolver: internal DNS, 10.10.0.2", would have answered that question in seconds.

Worked example (synthetic NCS)

Priya traces a logger reading: logger → radio → GW-LOG (10.30.0.5) → firewall rule 21 "10.30.0.5 to vendor cloud, TCP 443, allow" → internet. She also finds rule 9, "any to 10.20.0.0/24, TCP 502, allow", left from commissioning. Rule 9 lets office PCs reach the refrigeration controllers' Modbus port; she flags it for review.

Synthetic case — Northgate Cold Storage. Addresses and rule numbers are invented.

Errors and limits

A diagram may not match the firewall; the configuration export is the evidence. Never test rules by sending traffic to production controllers without a permit.

Exercises

Synthesis

Addresses, VLANs, rules and DNS determine which conversations are possible; reading them is how a technologist finds the unintended ones.

Continue studying — chapter 02 of 30

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →