Chapter 9

Network Security

How packets get filtered, encrypted, and dispersed — firewalls, VPNs, zero trust, and surviving a DDoS.

6 topics

Everything before this chapter assumed the network would faithfully carry your packets. This chapter assumes someone on the path wants to read them, forge them, or drown them. Network security is the set of controls you add when the wire is hostile: firewalls that decide which packets pass, VPNs that encrypt the ones that must cross untrusted ground, segmentation that limits what a single breach can reach, and DDoS mitigation for when the attack is simply too much traffic to serve.

The six topics build from the packet up. Firewalls and packet filtering are the same idea at two altitudes — theory, then the iptables, nftables, and cloud security-group rules you actually type. IPsec and WireGuard are two answers to the same tunneling problem, one heavyweight and standard, one lean and modern. Zero trust is the architecture you reach for once you accept that the perimeter will be breached. DDoS closes the chapter on the one attack you cannot simply firewall away.

Drop or pass packets by their 5-tuple (IPs, ports, protocol)→Firewall

Carry private traffic across an untrusted network unread→VPN

Authenticate every request, trusting nothing by location→Zero trust

Absorb a flood too large for any one origin to serve→DDoS mitigation