Module 76: API and Network Security
Firewalls and network layers
🏠The everyday picture
A city has a checkpoint at its border, a guard at each housing society's gate, and a lock on each flat. Getting past one doesn't open the others.
📘What it really is
- Network firewalls filter connections by address, port and protocol:
- cloud firewalls / security groups at the provider (Module 68);
- host firewalls like UFW on each server (Module 66);
-
both together: if one is misconfigured, the other still protects.
-
Default deny: block everything, then allow only what's needed. For your CRM's server: 443 and 80 from anywhere, 22 only from your own IP or a VPN if possible, nothing else.
-
Outbound rules matter too: a compromised server often "phones home". Restricting outgoing connections to known destinations limits the damage, though it's more work to maintain.
-
Web application firewalls (WAFs) such as Cloudflare's, AWS WAF, or ModSecurity in Nginx inspect HTTP requests and block common attack patterns. Helpful as an extra layer, never a replacement for fixing the app (Module 75).
-
DDoS protection: floods of traffic aimed at taking you offline. Providers like Cloudflare absorb most; your rate limits (Lesson 4) handle smaller abuse.
-
Brute-force protection on SSH: keys only, no root login (Module 64), plus fail2ban, which blocks addresses after repeated failures.
🖱️Try it
Review your server's UFW rules and your cloud firewall: write them out side by side and check both are default-deny. If your
home or office has a fixed IP, restrict SSH to it in the cloud firewall. Install fail2ban for SSH and check its status after a
day (sudo fail2ban-client status sshd). From outside, nmap -Pn your own server again and confirm only the expected ports
are open.
✅Quick check
Why use both a cloud firewall and a host firewall?
Show the answer
Defence in depth: if one is misconfigured, the other still blocks unwanted traffic.
Can a WAF replace fixing vulnerabilities in your app?
Show the answer
No. It's an extra layer that catches common patterns; the app must still be secure.