TechKnowSurge

VideoSecurityFree

Routers

Routers enable controlled communication between segmented networks by operating at Layer 3, and access control lists can be applied to restrict or permit traffic between those segments.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Segmenting a network into separate broadcast domains limits lateral movement and reduces the attack surface, but fully isolated networks are impractical in most environments. When inter-network communication is required, a Layer 3 device such as a router, firewall, or Layer 3 switch is needed to bridge those segments while maintaining logical separation. Each interface on a Layer 3 device connects to a different network segment, enabling controlled routing between them. A router alone, however, does not enforce any traffic restrictions by default. Without additional security measures, all segments can communicate freely, which undermines much of the benefit that segmentation provides. To close this gap, network access control lists (ACLs) can be applied directly to a router or Layer 3 switch to define which traffic is permitted or denied based on factors such as source host, destination host, or network range. Firewalls serve a similar purpose with more advanced inspection capabilities. Together, these controls allow organizations to enforce a least-privilege model at the network layer, ensuring that segmentation translates into meaningful security boundaries rather than just logical groupings.

What you'll learn

Explain the role of Layer 3 devices, including routers, firewalls, and Layer 3 switches, in enabling communication between segmented network segments
Describe how network access control lists (ACLs) are used to permit or deny traffic between network segments to reduce security risk

What's covered

Routers & Network Security

Network Segmentation
- Isolated Networks
- Need for Interconnectivity
Router Functionality
- Layer 3 Device
- Connects Multiple Networks
- Router Interfaces
Other Routing Devices
- Firewalls
- Layer 3 Switches
Access Control Lists
- Permit or Deny Traffic
- Applied to Router or Switch
- Controls Between Networks

Key terms

Router: A network device that forwards data packets between networks based on IP addresses.
Firewall: A network security device that monitors and controls incoming and outgoing traffic based on predefined security rules.
Layer 3: The Network layer of the OSI model, responsible for logical addressing and routing packets between networks.
Layer 3 Switch: A network switch that performs routing functions at Layer 3 in addition to standard Layer 2 switching, enabling inter-VLAN and inter-segment communication.
Network Segmentation: The practice of dividing a network into smaller segments to improve performance and limit the spread of security threats.
Access Control List: A set of rules that defines which users or systems are granted or denied access to a resource.

Topics

Networking Routers Layer 3 Network Segmentation Access Control Lists Firewalls Network Security

Transcript

Now when we segment out our networks, we probably want some interconnectivity. That is, we probably don't want a completely air-gapped or isolated network in most cases. In this case, we have to do some sort of routing.

Why We Need a Layer 3 Device

If we were to segment out our networks but do nothing else, then what we have is networks that don't communicate with each other, which might be what we want. We might want to create these isolated networks. But if we want some sort of intercommunication, or communication to the outside world, we need some sort of layer 3 device that will allow that. We need something like a router.

A router will have interfaces on it, interfaces that we can connect into each one of these networks. And by connecting each one of these networks, we'll now be able to communicate between these networks, from one network to another. There are other devices that will do routing as well, such as a firewall, and layer 3 switches are examples of these layer 3 devices.

A Router Alone Is Not Security

Now, by dividing up these different broadcast domains, we do eliminate some of our security concerns and it does make it more difficult, but a router by itself can still have some problems. We still have free communication between these networks, and so it still opens us up to a lot of risk if we just have a router but don't implement any security on the router.

So many times what we'll do is we'll either use a firewall or access control lists on that router or layer 3 switch, in order to implement some level of security to control the traffic between these different networks.

Network Access Control Lists

A network access control list allows us to either permit or deny certain traffic. So if it's coming from maybe one network and trying to make it to another network, or from one host and trying to make it to another host, or from a host to a network, or whatever the case may be, we can either say what is acceptable to go across and what isn't acceptable to go across. So that is what network access control lists are, and we put it on something like a layer 3 switch or a router.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →