◇ OpenCyber Academy
Technologist · Chapter 2 · English

Chapter 2 — Networks and internet services

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Networks and internet services

Lesson map

Lesson 02 published. Map, example, EX004.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Addresses"]
  N2["2.2 Ports and services"]
  N3["2.3 Internet services"]
  N4["2.4 Reading firewall logs"]
  N5["2.5 Internal versus external"]
  N6["2.6 Exposure"]
  N7["2.7 Case"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX004"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Addresses"]
  N2["2.2 Ports and services"]
  N3["2.3 Internet services"]
  N4["2.4 Reading firewall logs"]
  N5["2.5 Internal versus external"]
  N6["2.6 Exposure"]
  N7["2.7 Case"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX004"]

[Learning outcomes]
    |
    v
[2.1 Addresses]
    |
    v
[2.2 Ports and services]
    |
    v
[2.3 Internet services]
    |
    v
[2.4 Reading firewall logs]
    |
    v
[2.5 Internal versus external]
    |
    v
[2.6 Exposure]
    |
    v
[2.7 Case]
    |
    v
[Worked example] --> [Exercise EX004]

Learning outcomes

You will (1) explain IP addressing, ports and common internet services; (2) distinguish internal from external traffic; (3) read firewall connection logs; (4) recognise risky exposed services.

2.1 Addresses

Devices have IP addresses. Clinic PCs use private addresses (10.x.x.x) inside the clinic; the firewall translates them to one public address on the internet. Logs show which side an address belongs to.

At clinic 2 a reception PC such as 10.2.0.15 never appears on the internet under its own address; outside services see only the clinic's single public address. Inside the firewall log, a source beginning with 10. is therefore a clinic device, and a source such as 203.0.113.45 is an outside address. Mei reads every log line by first deciding which side each address belongs to.

2.2 Ports and services

Services listen on numbered ports: 443 for web, 3389 for remote desktop, 445 for file sharing. A firewall rule that forwards port 3389 from the internet to the server exposes remote desktop to anyone.

A port number on its own is only a label, so Mei checks what actually listens behind it. On CLINIC2-SRV port 3389 leads to the Windows remote desktop service, which accepts a username and password. A forward rule on the firewall turns that internal service into an internet service, which is why the forwarded 3389 line matters more than any other entry in the rule list.

2.3 Internet services

Clinics use cloud email, an online booking site and a card-payment terminal. Each creates connections the firewall logs.

These outbound services are expected, so their connections are normal background in the firewall log. Mei notes the destinations each one uses, such as the booking site and the payment provider, so that a reception PC connecting to them is not mistaken for something suspicious, and a connection to an unfamiliar destination stands out against that known list. The card-payment terminal, for instance, should only ever talk to its payment provider, so any other destination from it deserves a closer look.

2.4 Reading firewall logs

A log line shows time, source address, destination address, port and action (allowed or denied). Many denied connections from one external address to port 3389 suggest password guessing or scanning.

Mei reads a denied line as a refused attempt, not as a harmless one. When one external address sends dozens of attempts to 3389 within a few minutes, the pattern is guessing; when many different addresses each send a few attempts, it is broad scanning. Both are worth counting, but only an allowed connection followed by a server logon shows that someone actually got in.

2.5 Internal versus external

Activity from inside the clinic network is usually staff; from outside it is anyone. Detection rules treat them differently.

The difference between the two sides is written directly into Copperleaf's rules. Several failed logons whose source is 10.2.0.15 usually mean a receptionist mistyped a password after the morning start, whereas the same number from an internet address means someone outside is trying passwords. The lab in chapter 14 shows this split directly: the internal source is printed without an alert, while the external source crossing the limit is flagged.

2.6 Exposure

Exposed services are a common entry route. The safer design is a VPN: staff and the IT contractor connect securely first, and remote desktop is not exposed directly.

With a VPN in place, the internet sees only the VPN service, which can require MFA before any connection reaches the clinic network. Remote desktop is still used by the contractor, but only after the VPN logon succeeds. Exposure is reduced from a password box open to the world to a gateway that demands a second factor first.

2.7 Case

Mei filters clinic 2's firewall log for port 3389 and sees thousands of connection attempts per day from many countries.

The attempts are spread across the day and night with no pause for clinic hours, which is what automated tools produce. None of these addresses belongs to the contractor, whose support sessions are a few connections a week. The volume shows that the forwarded port has been found by internet scanners and is being tested constantly, regardless of whether any attempt has yet succeeded.

DNS and names

Devices look up names before connecting. DNS logs from the clinic firewall show which websites PCs tried to reach, useful when checking whether a PC contacted a suspicious site.

Worked example

Raj asks Mei to summarise. She writes: "Clinic 2's server accepts remote desktop connections from the internet on port 3389. Over seven days, 41,000 connection attempts came from 2,300 external addresses. Recommend VPN-only access." Raj sends it to the client as a high-priority recommendation.

Synthetic case. Logs and figures are invented.

Errors and limits

Firewall logs show connections, not whether logons succeeded; check the server's own logs.

Exercises

Synthesis

Addresses, ports and firewall logs show what a network exposes and who is knocking.

Continue studying — chapter 02 of 30

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →