TechKnowSurge

VideoSecurityFree

How Firewalls Work

Firewalls control network traffic by enforcing access rules on incoming connections while allowing outbound traffic to flow freely. This content covers how a stateful firewall like OPNsense manages multiple network interfaces to protect internal systems from unauthorized access.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

OPNsense is a widely used open-source firewall that can be installed on dedicated hardware or run in a virtual environment. It manages network traffic across multiple interfaces, typically including one or more LAN segments and a WAN interface that connects to the internet. Each interface has a distinct inbound path, where access control rules are enforced, and an outbound path that is left open by default, meaning traffic can exit freely but cannot enter without passing through the firewall's rule set. OPNsense operates as a stateful firewall, which means it actively tracks the details of each network session, including source and destination IP addresses and port numbers. When an internal host initiates a connection to an external server, the firewall records that session and uses that record to allow the server's reply traffic back through. This prevents external hosts from initiating unsolicited connections into the network, since no established session exists to authorize that inbound traffic. By default, only the first LAN interface is granted permission to reach the WAN, while all other configured LAN segments are blocked from communicating outbound or laterally with other LAN segments. Enabling communication between additional segments requires manually creating rules that explicitly permit that traffic. This default-deny approach gives administrators granular control over which systems can communicate with each other and with the outside world, forming the foundation of a well-segmented, defensible network architecture.

What you'll learn

Explain how a stateful firewall uses inbound access controls and session tracking to permit and restrict traffic between LAN, WAN, and multi-interface network segments
Describe how default and custom firewall rules govern inter-interface communication in a multi-zone firewall configuration

What's covered

How Firewalls Work

OPNsense Overview
- Popular Open Source Choice
- Requires Hardware or VM
Network Interfaces
- LAN 1 Interface
- LAN 2 Interface
- WAN Interface
Traffic Flow Rules
- Inbound Access Controlled
- Outbound Wide Open
- LAN 1 Default Outbound Access
- Other LANs Need Manual Rules
Stateful Firewall Tracking
- Records IP and Port Sessions
- Allows Return Traffic
Inter-LAN Communication
- Blocked by Default
- Requires Specific Rules

Key terms

Stateful Firewall: A firewall that tracks the state of active network connections and makes filtering decisions based on context.
Firewall: A network security device that monitors and controls incoming and outgoing traffic based on predefined security rules.
Ingress Filtering: The practice of monitoring and restricting inbound network traffic based on security policies.
Network Segmentation: The practice of dividing a network into smaller segments to improve performance and limit the spread of security threats.
Wide Area Network: A network that spans a large geographic area, connecting multiple local area networks.
Access Control List: A set of rules that defines which users or systems are granted or denied access to a resource.
Session Tracking: A stateful firewall function that records active connection details such as source and destination IP addresses and ports to permit return traffic automatically.

Topics

Firewalls Network Security Stateful Inspection Access Control Opnsense Network Interfaces Networking

Transcript

Different firewalls are going to behave differently depending on what brand and equipment you're using, so we have to choose one to go over how it functions. We're going to choose OPNsense. I chose OPNsense because it's very popular and it's also open source, so it's something you can download and play around with. Now, it doesn't come with the actual hardware, so you'd have to buy a piece of hardware and install OPNsense on top of that, or you could set it up in a virtual environment.

The interfaces

In our scenario here, we have a firewall and we are going to have three connections, three interfaces. We're going to have a LAN 1 interface, a LAN 2 interface, and a WAN interface. Of course, the WAN interface goes out to the internet. These are all sectioned off, so physically they're separated out, and we've got these actual devices plugged into here.

Each one of these interfaces has an in, so traffic coming from the LAN into the router, and then an out, so traffic coming from within the router to the outside. So something has to go from one LAN to another. For instance, let's say this machine is going to this machine. It has to go in this interface right here, and then it comes out this interface, and then the reply will come in through the LAN 2 interface and come out through the LAN 1 interface. That's how it communicates back and forth.

Access control on the ins

So how does OPNsense deal with this? What they do is they put an access control list in front of all of the ins, and this access control list is fairly restrictive. And then the out they leave just wide open, so anything can go out of those interfaces.

Initially, when you set it up, on the WAN interface nothing like an adversary can get through this security guard right here. Something from this server cannot get through this security guard right there, so they can't get into this network. And then most interfaces that you set up will, once again, try to get into this machine or send traffic, and it comes in through this interface and there's a security guard, so they can't communicate at all. There's no communication that's happening from most of these LANs that you're going to set up, except for the first LAN.

For the first LAN, what they do is they set up this ability for this computer to go out, or to go into the interface. So what will happen is that this can communicate in through this interface and then out, and get to the outside world.

Stateful tracking and additional rules

What happens is we have that established traffic, because this is a stateful firewall. What it does is it records that this machine right here, the IP address, is going to this machine right here, and it records what port it is, and it's tracking that session and everything. That way, when this server responds, it can get back through to this machine right here.

Now, if we set up other interfaces, if we want them to communicate, we're going to have to allow them to communicate to the outside world as well for them to communicate.

Also, if you notice, with this setup you can't communicate from this LAN to this LAN because of the security guard right here. In order to allow that communication, we would have to open up a hole, add a rule that allows it to communicate from this LAN out to this LAN right here. We'd have to specifically set that up.

So what does that mean? That means that from the outside world, they can't just initiate a communication with anything internally. There has to be something internally that reaches out to them. From LAN 1, by default, it has permission to get to the outside world, to the WAN interface and to the rest of the world, and that establishes traffic so it can come back in. But other LANs that you set up on here, you're going to have to set up specific rules that allow that same similar type of communication.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →