Level 3 · 3C Networks · Lesson 3 of 3
Firewalls, Wi-Fi and VPNs
A firewall is the doorman of a network or a machine: it has a list of which connections are accepted (for example, 443 from anywhere) and blocks everything else. It also logs what it does, and that log tells you a lot about who's testing the doors.
Reading the firewall log
Each line says the time, whether it let the connection through (ACCEPT) or stopped it (DROP), which IP it came from and which port it tried to reach. A single IP trying many different ports in seconds is scanning; an IP knocking many times on the same port (like 22) is guessing passwords.
grep DROP cortafuegos.log | cut -d" " -f3 | sort | uniq -c | sort -rn- grep DROP keeps only the blocked connections.
- cut -d" " -f3 extracts the third column: the source IP.
- sort, uniq -c and sort -rn count how many times each IP appears and put the one that knocked most on top.
Your everyday network
At home: the router with your own password (never the factory one), up to date, and the Wi-Fi with WPA2 or WPA3 and a long password. Out and about: on public Wi-Fi use only HTTPS sites or your phone's data, and be wary of networks with look-alike names. A VPN encrypts the path up to its server, but it doesn't protect you from a fake page or an infected file.
Going deeper
Defense in layers
No single barrier is enough. The firewall stops what shouldn't get in, HTTPS protects what travels, strong passwords and the second step protect accounts, and logs warn you when something odd happens. If one layer fails, the next one is still standing.
Review questions
In the firewall log, one IP tries 40 different ports in ten seconds. What is it?
Answer: A port scan. Many different ports in a short time is the trace of someone looking for an open door.
Which security should your home Wi-Fi use?
Answer: WPA2 or WPA3 with a long password. WEP is broken in minutes and hiding the name doesn't protect anything. WPA2 or WPA3 with a long password does.
What does a VPN NOT protect you from?
Answer: Landing on a phishing page. The VPN encrypts the path, but if you go to a fake page, you hand over your data anyway.