AP Networking 2.6: Firewalls and Network Segmentation

A firewall filters traffic between network zones using rules about source, destination, and service; on a SOHO router the baseline is deny inbound from the internet by default. Network segmentation divides one network into zones grouped by trust and need-to-communicate, so a breach is contained and each zone carries less congestion.

This is Topic 2.6 of AP Networking Unit 2, and it closes the Computer Lab Disconnected scenario. Topic 2.5 named the vulnerabilities; this topic applies the fix: read firewall rules the way the router does, split the lab into zones, and document what may cross each boundary and why.

• What does a firewall do?
• Default deny: the baseline posture
• Rules as narrow as the need
• What is network segmentation?
• How to group devices into zones
• Shared zone or cross-zone rule?
• Segmenting the computer lab
• Practice: Segment It
• Using AI safely
• Key terms
• Frequently asked questions

What does a firewall do?

A firewall is a rule-matcher standing at a boundary between network zones. Each rule asks three questions about a connection: where is it from (source), where is it going (destination), and what service is it asking for (web, print, game)? Match an allow rule and the traffic passes; match nothing and the connection is refused.

You already own one: every SOHO router ships with a firewall between the internet and everything in your house. The same engine can guard boundaries between internal zones once you create them.

A firewall is not an antivirus, not a VPN, and not DHCP. It answers one question, connection by connection: does a rule say this may pass?

Default deny: the baseline posture

The most important rule is the one that runs when nothing else matches. On a SOHO router the baseline is default-deny inbound: any connection started from the internet is refused unless a rule explicitly allows it. The first check in any security pass is confirming nobody has traded that posture away.

If inbound is denied, how does a web page ever arrive? Because browsing is outbound. Your desktop starts the conversation, and the replies are let back in. Default-deny refuses what an outsider starts: the port scan, the bot probing your router's admin page. The front door is locked; walking out and coming back is still allowed.

Rules as narrow as the need

When a real need does justify an allowance, write the smallest rule that serves it: one source, one destination, one service. A game server friends join from the internet needs one forwarded port pointed at one PC. Students who print need the print service, from the student zone, to the printer zone, and nothing more.

What is network segmentation?

Segmentation divides one network into zones so each device can reach only what it needs. On a flat network the visitor's phone can ping the gradebook desktop, and the never-updated smart plug sits beside the work laptop. Nobody asked for those paths. Zones remove them.

Segmentation pays off twice:

• Security: containment. A compromised device can attack only its own zone. When the smart plug gets hacked, the attacker scans two other smart devices and hits a wall; no allow rule points at the laptop or the file server. On a flat network, the same plug could reach everything.
• Performance: less chatter per zone. Flat networks make every device hear every broadcast and share every burst of congestion. Zones split the load. Split a crowded network into three zones and video calls stop stuttering without removing a single device.

On SOHO gear you build zones with features the router already has: the guest network toggle, an extra SSID for smart devices. Subnetted multi-segment designs come in Unit 3; here the skill is deciding what goes where and why.

How to group devices into zones

Group by trust level and need-to-communicate, never by brand or room. A smart TV and a work laptop in the same room belong in different zones; two cameras on opposite walls belong in the same one.

Zone	Who lives there	Why
Trusted	Work and school laptops, personal phones, the file server	Patched, managed devices holding data that matters. Nothing starts connections into this zone.
IoT / smart	Smart TVs, plugs, speakers, cameras, the thermostat	Most often compromised, least patched. Their own zone contains the damage when one falls.
Guest	Visitors' phones and laptops	The everyday SOHO segment: internet access, no internal path. Untrusted by definition, politely.

Trust asks how likely the device is to be compromised, and how bad it is if something reaches it. Need-to-communicate asks what it must actually talk to. Answer both per device and the zone map draws itself. The guest network is the version you can deploy at home in five minutes.

Shared zone or cross-zone rule? The design tradeoff

Devices that must talk have two options: share a zone, or get a specific firewall rule across the boundary. Choosing between them is the design skill this topic and the exam test.

Worked example. A media server streams to two smart TVs every evening. The owner's work laptop must stay away from the rarely-updated TVs. Two designs compete:

• Design A: TVs in an IoT zone, server in the trusted zone, an allow rule between them. Every night's streams cross the boundary, and the new rule is exactly the path you were trying to remove.
• Design B: server and TVs share one media zone; the laptop sits alone in the trusted zone. The heavy traffic never crosses a boundary, and no rule connects the TVs to the laptop. B wins on both axes.

The rule of thumb: constant heavy traffic argues for a shared zone; an occasional need argues for one narrow rule. Adding films from the laptop once a week is the occasional case: one rule, reaching only the server's file-upload service.

Step-by-step: segmenting the computer lab

The Unit 2 scenario ends here. The lab is documented (2.2), upgraded (2.3), and its vulnerabilities are named (2.5). The final pass draws the boundaries.

1. List the trust levels. Staff devices (gradebook desktop, teacher laptop), student desktops, visitors' phones, the shared printer. Four levels, four zones.
2. Assign every device from the 2.2 documentation table. Each MAC row gets a zone; a device you cannot place is a device to investigate.
3. Start from deny. Between zones, nothing passes by default. Every path that exists from here forward is one you wrote down on purpose.
4. Add the narrow rules real needs justify. Print-service traffic from the staff and student zones into the printer zone. Guest zone to the internet only. That is the whole list.
5. Write the reason next to each rule. "Everyone prints, jobs are small." A rule with no written reason is one nobody will ever dare remove.
6. Test the boundaries. Student desktop to gradebook desktop: refused. Print: works. Guest to anything internal: refused. The failures are the proof the design works.

Practice: Segment It

Warm up with three sample questions, then work the cases. Each case states a security constraint and a performance constraint; only one grouping satisfies both.

Three free sample questions

1. The router denies all inbound connections from the internet, yet web pages load normally. Why?

Show answer

Browsing is outbound: the desktop starts the conversation and the replies are let back in. Default-deny refuses connections outsiders start (EK 2.6.A.2).

2. Which two facts about a device decide its zone?

Show answer

How much you trust it, and what it must talk to. Not brand, not room (EK 2.6.B.1).

3. A media server streams to two smart TVs nightly. Shared zone or cross-zone rule?

Show answer

Shared zone: constant heavy traffic should not cross a boundary. Save cross-zone rules for occasional, narrow needs (EK 2.6.B.5).

Now the full case set, shuffled every run so you reason from the constraints.

Using AI to draft rules and groupings, safely

An AI assistant is genuinely useful here: hand it your device list and it proposes a zone map and rule set in seconds. Let it. Then verify every suggestion; a confident rule pointing the wrong way is worse than no rule at all.

The verification pass checks three things. Direction: who starts the connection? The phone controls the plugs, so the allowance points from trusted into IoT; "allow all traffic from IoT into trusted" has it backwards. Breadth: "forward ports 1-10000 for the cameras" serves a one-port need with ten thousand. Grouping logic: trust and need-to-communicate, or a quiet sort by brand and room? AI drafts; the technician verifies. That division of labor is a graded skill here.

Key terms

Firewall

A filter between network zones that checks each connection against rules about source, destination, and service.

Default deny

The baseline posture: refuse any inbound connection no rule explicitly allows. Outbound conversations and their replies still flow.

Network segmentation

Dividing one network into zones so each device can reach only what it needs.

Zone (segment)

Devices sharing a trust level that reach each other freely; the firewall guards the boundary.

Containment

The security payoff of zones: a compromised device can attack only its own segment.

Guest network

The everyday SOHO segment: visitors get internet access and no path to anything internal.

IoT zone

A segment for smart devices, the most often compromised and least patched things on the network.

Port forwarding

A deliberate exception to default-deny: one inbound service passed to one internal address.

Frequently asked questions

What does a firewall actually do?

It checks every connection crossing a boundary against rules about source, destination, and service, and passes only what a rule allows. Scanning files, encrypting traffic, and assigning addresses are jobs for other tools.

If my router blocks inbound traffic, why do websites still load?

Browsing is outbound. Your device starts the conversation and the firewall lets the replies back in. Default-deny only refuses connections that outsiders start.

What is network segmentation in simple terms?

Splitting one network into zones so devices can only reach what they need. A breach then stays inside its zone, and each zone carries less traffic.

How should I decide which zone a device goes in?

Ask two questions: how much do you trust it, and what must it communicate with? Group by the answers, never by brand or by room.

Why do smart devices need their own zone?

They are the most often compromised and least patched devices on a network. Their own zone means a hacked plug can only attack other smart devices, not your laptop.

Is a guest network really segmentation?

Yes, the most common example. Guests get a path to the internet and none to anything internal: a full segmentation boundary from one toggle in the router settings.

Two of my devices need to talk across zones. Rule or same zone?

Constant heavy traffic (a media server and its TVs) argues for sharing a zone. An occasional need (adding files once a week) argues for one narrow rule: one source, one destination, one service.

Does segmentation make my network faster?

It can. Each zone carries only its own broadcast chatter and congestion, so heavy traffic in one zone stops slowing the others. That is why grouping is judged on performance too.

AP is a trademark of the College Board, which was not involved in the production of, and does not endorse, this resource.