Lesson 5 of 9

Firewalls & IDS/IPS

Firewalls and intrusion detection systems are the primary defensive controls that network security teams deploy to detect and block attacks. You will learn how different firewall types work, how to configure basic rules, and how IDS/IPS systems like Snort detect malicious traffic patterns. Understanding these defenses helps you both deploy them effectively and understand how attackers try to evade them.

Learning Objectives — Deep Dive

Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.

0/4

In plain English

This is asking you to build a clear mental model of the concept — not just memorize a definition, but genuinely understand what it means, why it exists, and how it connects to everything else you are learning. When you can explain "different firewall types and their capabilities" in your own words to someone who has never heard of it, you have truly learned it.

Why this matters

This objective builds a foundational skill that every security professional uses regularly. Mastering it gives you the vocabulary, mental models, and practical ability to tackle more advanced topics with confidence — and to communicate clearly with both technical and non-technical colleagues.

Real-world analogy

Think of it like learning to drive. You do not need to understand how the engine works to drive safely, but knowing the basics helps you diagnose problems and avoid mistakes that could cause accidents. The same principle applies here — foundational knowledge prevents costly errors.

What you will be able to do

Apply this skill in a real lab environment, explain it clearly to a colleague or client, and use it as a building block for the more advanced techniques that come later in this course.

Beginner tip

Do not try to memorize everything at once. Read through the material once to get the big picture, then go back and work through the lab. The hands-on practice is what makes the concepts stick — passive reading alone will not get you there.

Firewalls & IDS/IPS · Objective 1 of 4

VIDEO

Loading video…

View current iptables rules

Run 'sudo iptables -L -v -n' to list all current iptables rules with verbose output and numeric addresses. The -v flag shows packet and byte counters, and -n prevents DNS lookups that would slow down the output. You will see three default chains: INPUT (incoming traffic), OUTPUT (outgoing traffic), and FORWARD (traffic being routed through the machine). Before making any changes, save a backup by running 'sudo iptables-save > ~/iptables-backup.txt' so you can restore the original state if something goes wrong.

Set default drop policies

Run 'sudo iptables -P INPUT DROP' and 'sudo iptables -P FORWARD DROP' to set the default policy for the INPUT and FORWARD chains to DROP. This implements a deny-by-default posture, meaning any traffic not explicitly permitted by a rule will be silently dropped. Do not set OUTPUT to DROP yet — doing so before adding allow rules will immediately cut off all outbound connections, including your SSH session if you are working remotely. A common mistake is setting all three chains to DROP simultaneously and locking yourself out of the system.

Allow established connections

Run 'sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT' to allow return traffic for connections you initiated. Without this rule, your machine can send packets out but will drop all responses, breaking every outbound connection. The conntrack module tracks connection state, so this single rule handles all return traffic for TCP, UDP, and ICMP connections. This is the most important rule in any iptables firewall — it must be added before any DROP policies take effect on established sessions.

Add specific allow rules

Add rules for the services you want to allow inbound: 'sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT' for SSH, 'sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT' for HTTP, and 'sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT' for HTTPS. Also allow loopback traffic with 'sudo iptables -A INPUT -i lo -j ACCEPT'. Add rules in order of most-to-least specific, since iptables processes rules sequentially and stops at the first match. Only open ports for services that are actually running on the machine.

Test the ruleset

From a second VM on the same network, attempt to connect to each allowed port using 'nc -zv <kali-ip> 22' for SSH and 'curl http://<kali-ip>' for HTTP. Allowed connections should succeed, and connections to any other port should time out or be refused. Also test that your own outbound connections still work by running 'ping 8.8.8.8' and 'curl https://example.com' from the Kali machine. Document which tests passed and which failed — any unexpected result indicates a rule ordering or logic error.

Save the rules

Run 'sudo iptables-save > /etc/iptables/rules.v4' to save your ruleset so it persists after reboot. On Debian/Ubuntu systems, install the iptables-persistent package with 'sudo apt install iptables-persistent', which will automatically restore saved rules at boot. Verify the saved file looks correct by running 'cat /etc/iptables/rules.v4' and checking that all your custom rules are present. Without saving, all iptables rules are lost on reboot — a common mistake that leaves systems unprotected after a restart.

Previous: Man-in-the-Middle Attacks Next Lesson