TechKnowSurge

VideoSecurityFree

Screened Subnets

A screened subnet is an isolated network segment that allows external users to access specific services while keeping the internal network protected behind a firewall. This architecture limits the blast radius of a compromised public-facing server by ensuring it never has a direct path to internal systems.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

When organizations need to give external users access to internal services like web servers, simply opening ports through a firewall into the main network creates serious risk. If a publicly accessible server is compromised, an attacker who already has a foothold inside the network boundary can potentially move laterally to reach sensitive internal systems. The screened subnet architecture addresses this problem by placing public-facing servers in a separate, isolated network segment that is distinct from the core internal environment. In this model, firewall rules permit external traffic, typically on ports 80 and 443, to reach servers in the screened subnet while a firewall continues to protect the internal network behind it. This can be implemented with a single firewall using separate interfaces or with two firewalls, one facing the public internet and one separating the screened subnet from internal systems. Either configuration ensures that even a fully compromised public-facing server does not grant an attacker direct access to internal resources, making the screened subnet a foundational concept in network perimeter security design.

What you'll learn

Explain the purpose of a screened subnet and how it isolates publicly accessible services from the internal network
Distinguish between single-firewall and dual-firewall screened subnet architectures and the security role each plays

What's covered

Screened Subnets

The Problem
- External Access Needed
- Firewall Holes Required
- Compromised Server Risk
  - Exposes Entire Network
Screened Subnet Solution
- Dedicated Separate Network
- Isolates Public Services
- Limits Breach Impact
Common Services Exposed
- Port 80 HTTP
- Port 443 HTTPS
- Web Servers
Firewall Configurations
- Single Firewall Setup
- Dual Firewall Setup
  - Extra Layer of Protection

Key terms

Screened Subnet: A dedicated network segment that hosts publicly accessible services, isolating them from the internal network so that a compromised host cannot directly access internal resources.
Demilitarized Zone: A network segment that sits between a trusted internal network and an untrusted external network, hosting public-facing services.
Firewall: A network security device that monitors and controls incoming and outgoing traffic based on predefined security rules.
Network Segmentation: The practice of dividing a network into smaller segments to improve performance and limit the spread of security threats.
Packet Filtering: A firewall technique that inspects packets and allows or blocks them based on source, destination, and protocol.
Port: A logical endpoint for communication in a network, identified by a number that specifies a particular service or application.

Topics

Screened Subnet Network Security Firewall Dmz Network Architecture Network Segmentation

Transcript

There are times we want external users to be able to get into our internal systems. Now, this could be problematic when they are in our internal network. So maybe what we do instead is put them on a whole other network. We call this a screen network, or a screened subnet. So let's take a look at those screened subnets.

The problem with poking holes into the internal network

Let's say we have some web servers and they're hosting a bunch of different services that we want external users to be able to get to. What we're going to have to do is open up holes in our firewall in order to allow those outside users to get to this web server.

If that web server were ever to be compromised, they would then have access to the whole network, the whole internal network. We're deliberately already letting them into our network, and if they find that vulnerability, then everything is compromised. This is problematic.

The screened subnet

So this is where we want to use a screened subnet instead. A screened subnet is going to be a whole network that's dedicated for those purposes, where you can poke a hole into your firewall to allow users to get to your web server. In this case right here, maybe it's port 80 or port 443 to get to these web servers, and then get to our resources.

Now, if those machines were ever to be compromised, they still can't get into the rest of your network, because we still have a firewall in between the two.

The two-firewall version

This is another view, or another way that we could set this up. In this case right here we've set it up with two firewalls. In this case right here we'd poke a hole into here for port 80 and 443 to our web server, so now users can get to that. But if that were compromised, we still have a whole other firewall, so that they can't get into these devices down here.

Whether you have two firewalls or one firewall, we're still adding this screened subnet, which is this other network that is going to be opened up. Some of the services will be opened up to the outside world, but it's still then separate from the rest of our network.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →