Firewalls & Network Defense
To bypass defenses, you must first understand how they work. This module covers the core network security controls you'll encounter during assessments.
Know Your Enemy
Firewall Types
Packet Filtering (L3/L4)
Examines packet headers only. Fast but limited visibility. Makes decisions based on source/dest IP, ports, and protocol.
Stateful Inspection (L3/L4)
Tracks connection state (SYN, ACK, etc.). Blocks packets that don't belong to established sessions.
Application Layer (L7 / WAF)
Deep packet inspection. Examines HTTP payloads, SQL queries, etc. Can block specific attack patterns.
Next-Gen Firewall (NGFW)
Combines stateful inspection, DPI, IPS, SSL inspection, and application awareness. Palo Alto, Fortinet, Cisco.
IDS vs IPS
| Feature | IDS (Detection) | IPS (Prevention) |
|---|---|---|
| Mode | Passive (monitoring) | Inline (blocking) |
| Action | Alerts only | Blocks + Alerts |
| Latency | None | Adds latency |
| Risk | Missed attacks | False positives block legit traffic |
| Examples | Snort, Suricata, Zeek | Snort (inline), Suricata, Palo Alto |
Evasion Techniques
Network Segmentation
Segmentation limits lateral movement. Understanding how networks are divided helps identify pivot points.
VLANs
Layer 2 logical separation. Can be bypassed via VLAN hopping (double tagging, switch spoofing).
Subnets + ACLs
Layer 3 separation with router ACLs controlling traffic. Look for overly permissive rules.
Micro-segmentation
Host-level firewalls, zero trust. Every workload isolated. Harder to move laterally.
Zero Trust Architecture
"Never trust, always verify." Zero Trust assumes the network is compromised and requires continuous authentication.
Zero Trust Principles
- ✓ Verify explicitly: Always authenticate and authorize based on all data points
- ✓ Least privilege: Limit access with just-in-time and just-enough access (JIT/JEA)
- ✓ Assume breach: Minimize blast radius, segment access, verify end-to-end encryption
Pentest Implication
Firewall Enumeration Commands
Detect Firewall with Nmap
# ACK scan to detect filtered ports (firewall present)
nmap -sA -p 1-1000 <target>
# Compare with SYN scan
nmap -sS -p 1-1000 <target>
# Firewall version detection
nmap --script=firewalk <target>WAF Detection
# wafw00f - WAF fingerprinting
wafw00f https://target.com
# Nmap WAF detection
nmap --script=http-waf-detect <target>
# Manual test - send malicious payload
curl "https://target.com/?id=1' OR 1=1--" -vEvidence Collection
A bypass claim needs the rule, the packet and the hop that acted on it. Keep all three:
The rule table as configured: The firewall policy, NSG or ACL export for the segment in scope, with each rule ordinal, its action and its hit counter, and the date the export was taken.
The flow, from a named vantage:
The pcap or tcpdump line showing your SYN, the source address it left from, and whether a SYN-ACK, an RST or nothing returned - plus which subnet or VPN you were on.
Which control acted: The specific hop that dropped the traffic: a WAF rule id, a security group deny, an IDS signature, or the host firewall. "The firewall blocked it" is not a control.
Detection records: For anything the page treats as inspectable, the IDS/IPS alert id, signature, and mode - alert versus prevent - at the time of the test.
False Positive Identification
- A control enforced upstream: A WAF, load balancer or cloud security group can reject the request before the rule you are testing is ever evaluated. Confirm which layer answered before reporting a rule as missing.
- An alert is not a block: An IPS signature in alert mode logs the attempt and lets it through. Detection coverage and prevention coverage are separate findings and must be reported separately.
- Lab-only configuration: An any-to-any rule on a lab, build or temporary migration segment is not a production exposure. Check the segment purpose and the rule age before writing it up.
- Unanswered ICMP: A ping that gets no reply is the default policy doing its job. Use a TCP or UDP probe against a port the rule table says is allowed before concluding the path is closed.
Remediation & Defense
Defense in depth means the same flow meets a different control at each boundary.
Rule posture
- • Default-deny inbound and outbound, with an explicit allow per application, per source and per destination port.
- • Review rules by hit counter and age, not by intent: expire temporary rules and delete shadowed ones behind a broader rule.
- • Keep the deny rules logging, and alert on repeated denies from a single source as a scan signal.
Inspection
- • Run IDPS in prevent mode on the boundaries that carry untrusted traffic, and record the mode in the baseline.
- • Terminate and inspect TLS where policy and law permit; otherwise control by SNI, category and destination rather than pretending to see payload.
- • Use threat-intelligence deny rather than alert for known-bad destinations, with an explicit allow for anything operational that overlaps.
Architecture
- • Hub-and-spoke with one inspected egress, so every spoke inherits the same rule set instead of inventing its own.
- • Apply NSGs per subnet as well as at the firewall, and put the management plane behind Bastion or a dedicated management segment.
- • Re-test after every rule change; a change window is the most common moment for a boundary to silently open.