Reference architecture — Segmentation and DMZ

The reference architecture’s segmentation is not a suggestion; it is a default-deny model where every inter-VLAN packet must be explicitly allowed. This lesson spells out the VLAN plan and the rule structure.

The VLAN plan

VLAN  Tag  Subnet             Purpose
----  ---  ------             -------
10    10   10.10.0.0/24       Management
20    20   10.20.0.0/24       Users (corporate)
30    30   10.30.0.0/24       Servers (internal)
40    40   10.40.0.0/24       DMZ (public services)
50    50   10.50.0.0/24       Guest WiFi
60    60   10.60.0.0/24       IoT
70    70   10.70.0.0/24       Backup network
80    80   10.80.0.0/24       Voice / VoIP
99    99   10.100.0.0/24      Firewall management

The /24 per VLAN gives 253 usable addresses. For larger segments, use /23 or /22. The plan is documented; every firewall change references it.

The firewall has these interfaces, each bound to a VLAN on the LAN trunk:

The LAN parent is the trunk interface (typically ix0 or igb0). Each VLAN is a child interface with its own IP.

The default-deny rule structure

Every interface has, in order, these rules:

1. Anti-lockout (automatic on LAN): allow access to the firewall itself from a specific source.
2. Default deny: block all traffic from this interface to any other interface.
3. Specific allows: rules permitting the specific flows that should cross this boundary.

The default-deny rule on each interface is what enforces the segmentation. Anything not explicitly allowed is dropped.

USERS interface rules:
  Pass:  USERS net → DNS (TCP/UDP 53) → SERVERS_DNS
  Pass:  USERS net → TCP 80/443 → DMZ_WEB_PROXY (if proxy)
  Pass:  USERS net → any (Internet) via gateway group
  Block: USERS net → any other VLAN
  Block: USERS net → firewall (except anti-lockout sources)

Each rule references aliases. The aliases (SERVERS_DNS, DMZ_WEB_PROXY) are maintained separately and referenced by many rules.

The DMZ isolation rules

The DMZ is the most important isolation. The DMZ hosts public services (web, mail, DNS); if compromised, the attacker must not reach the corporate LAN.

DMZ rules:

DMZ interface rules:
  Pass:  DMZ net → any (Internet) via gateway group     (for updates)
  Pass:  DMZ net → SERVERS_DNS (TCP/UDP 53)            (for DNS)
  Block: DMZ net → USERS net
  Block: DMZ net → SERVERS net
  Block: DMZ net → MGMT net
  Block: DMZ net → GUEST net
  Block: DMZ net → IOT net
  Block: DMZ net → BACKUP net
  Block: DMZ net → VOICE net
  Block: DMZ net → firewall (except anti-lockout sources)
  Pass:  Internet → DMZ net (TCP 80/443) via port forward (inbound)

The inbound rule is the only exception to “DMZ cannot initiate connections”. Public traffic from the Internet hits the DMZ only via port forward, which means DNAT + state.

The rules are evaluated top to bottom. A specific pass rule above a block rule wins. The order matters: place internet-facing pass rules first, isolation block rules last.

Why this structure scales

The default-deny model scales because:

• Adding a VLAN adds one interface and one default-deny rule.
• Adding a service adds one allow rule and one alias.
• Removing a service removes one allow rule (the default-deny re-engages).
• Auditing the ruleset is a matter of enumerating the allow rules; the block rules need not be reviewed.

A “permissive with explicit block” model scales worse because every new service implicitly inherits the permissive default, and the block list grows indefinitely.