Build a screened subnet and prove the containment

applied · 55 min · Objective 4.3

Task

Implement the zone that every exam question about "a server that must be reachable from the internet" is asking for. You will place a public server in a screened subnet, write the three rules that define it, and then prove the one property that makes it worth building: a server compromised in the screened subnet cannot reach the internal network.

Steps

  1. Name the zones by interface so the policy reads in zone terms, not address terms: untrusted (the internet-facing side), screened (the server subnet), trusted (internal). Write the intended policy in one line each before you type a rule.
  2. Rule one — the internet may reach the screened subnet on the service port only: permit untrusted to 192.168.20.10 on TCP 443, and nothing else inbound.
  3. Rule two — the screened subnet may not initiate into trusted. Default deny from 192.168.20.0/24 to 192.168.10.0/24. This is the rule that does the containment work, so add it deliberately rather than relying on the default.
  4. Rule three — internal may reach the screened subnet as needed: permit 192.168.10.0/24 to 192.168.20.10. Now test all three: the web port is reachable from outside, internal can administer the server, and the server cannot open a connection back into internal.
  5. Simulate the compromise. From Host B (the exposed server, now imagine it is the attacker's foothold), try to reach Host A on any port. It must fail — that failure is the entire justification for the zone.

Verify

sudo iptables -L FORWARD -n -v | grep -E "192.168.10|192.168.20"
nc -z -w 3 192.168.20.10 443; echo "internet to web exit $?"
ping -c 1 -W 2 192.168.10.10 && echo "SERVER REACHED INTERNAL - containment broken"
nc -z -w 3 -s 192.168.20.10 192.168.10.10 22; echo "server to internal exit $?"

The result that matters is the server-to-internal test failing. If Host B can reach Host A, the screened subnet is decorative — a compromised public server would own the internal network. A non-zero exit on that last test, with the web port still reachable from outside, is the containment proven.

Notes

The design principle is that the most-likely-compromised system — the one deliberately exposed to the internet — is placed where a compromise is contained. The screened subnet is a blast radius, not a lock: it assumes the front-facing box will eventually fall and arranges for that to be survivable.

This is the same idea domain 1's zero-trust lesson pushed further. A screened subnet trusts a host based on which zone it sits in; zero trust stops trusting the zone and re-checks every request. The screened subnet is the pragmatic version most networks actually run, and it is the answer the exam wants when a scenario needs one server public and everything else protected.

Anticipate the twist: the server needs to reach a database on the internal side. The defensible answer is a single permitted flow to one host on one port with a documented exception — not opening the screened-to-trusted boundary generally.