Firewalls, VPN & Compliance
Your JD asks for "Familiarity with firewalls, VPN, and network security" and "Ensure network security and compliance with policies". You do not need to be a firewall engineer — you need to speak correctly.
What a firewall does
A firewall applies rules to traffic at a boundary. Its job is to permit what is required and deny everything else.
| Rule component | Example |
|---|---|
| Source | 192.168.10.0/24 |
| Destination | 10.0.0.5 |
| Service / port | TCP 445 |
| Action | Allow / Deny |
| Logging | Enabled, because silent denials waste everyone's afternoon |
The first matching rule wins. A broad "Allow Any" placed above a Deny makes every rule below it dead. This is the single most common firewall misconfiguration, and knowing it signals real experience.
The types
| Type | State |
|---|---|
| Packet filter / stateless | Examines headers only. Fast, blind to session state. |
| Stateful inspection | Tracks connections in a state table. The standard today. |
| Next-gen (NGFW) | Adds application awareness and user identity |
| Web / proxy | Filters browser traffic, inspects content |
| Host-based | Runs on the endpoint, not the network edge |
# The Windows Firewall is host-based and stateful
Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction
Get-NetFirewallRule -Direction Inbound -Enabled True |
Select-Object DisplayName, Action, Profile
# Open a specific port
New-NetFirewallRule -DisplayName "Allow RDP 3389" `
-Direction Inbound -Protocol TCP -LocalPort 3389 -Action Allow
Opening inbound RDP on 3389 straight to the internet is how ransomware arrives. If a rule is needed, restrict the source to the corporate range or a VPN subnet. If a service needs a public port, put a reverse proxy in front.
Ports you will be asked to filter
| Port | Service | Policy position |
|---|---|---|
| 21 | FTP | Deny. Cleartext credentials. |
| 23 | Telnet | Deny. Cleartext. Use SSH (22). |
| 3389 | RDP | Restrict to VPN or corporate ranges |
| 445 | SMB | Restrict to the internal network |
| 135–139 | NetBIOS | Block at the internet edge |
| 5900 | VNC | Deny outbound unless approved |
| 25 | SMTP | Only to the mail gateway |
WannaCry propagated over SMB port 445. Blocking 135–139 and 445 at the internet edge, and segmenting VLANs, is what stops lateral movement. Naming this when asked "how do you reduce ransomware risk?" is a strong answer.
VPN types
| Type | Use case | Ports |
|---|---|---|
| Remote access (SSL/TLS) | One user connecting to the corporate network | 443/TCP |
| Site-to-site (IPsec) | Branch office to head office | 500/UDP IKE, 4500/UDP NAT-T |
| L2TP over IPsec | Legacy remote clients | 1701/UDP inside the tunnel |
| OpenVPN | Open-source, widely used | 1194/UDP or 443/TCP |
| WireGuard | Modern, lightweight, fast | 51820/UDP |
Many corporate networks block UDP 500. IPsec falls back to UDP 4500 and wraps itself inside a UDP packet so it looks like ordinary traffic. Knowing this explains why "the VPN works at home but not in the office" is usually a firewall rule, not a client problem.
Where a VPN fails
| Symptom | Check |
|---|---|
| Cannot resolve the VPN gateway | DNS |
| Cannot reach the gateway at all | Firewall blocking 500/4500/443 |
| Connects then drops | NAT or conflicting subnet routes |
| Certificate errors | Expiry, or clock skew |
| Works for others | The client profile — stale credentials or a bad config |
Test-NetConnection vpn.corp.local -Port 443
Resolve-DnsName vpn.corp.local
Defence in depth
- Perimeter firewall — blocks the obvious from outside.
- Internal segmentation (VLANs) — stops lateral movement.
- Host firewall — Windows Firewall on every machine.
- Patch management — closes known vulnerabilities.
- Endpoint protection (EDR) — detects behaviour, not just signatures.
- Least privilege — not everyone is an administrator.
- Logging and monitoring — you cannot respond to what you never record.
Compliance — what "compliance" means to a support engineer
| Control | Practical implementation |
|---|---|
| Data at rest | BitLocker on laptops and servers |
| Data in transit | TLS everywhere; disable legacy protocols |
| Password policy | Minimum length, history, lockout threshold |
| Account lifecycle | Joiner / mover / leaver process |
| Least privilege | Tiered admin, no shared accounts |
| Audit logging | Log retention, forwarded to a central collector |
| Physical security | Locked comms room, cable security |
| Acceptable use | Documented and acknowledged |
When someone leaves, three things must happen: their AD account is disabled or deleted, their files are transferred to their manager, and their access tokens and devices are recovered. Not doing this is the most common real-world security failure, and describing it shows you understand process, not just products.
Common interview questions
How would you reduce ransomware risk?
"Layered: block SMB and legacy protocols at the internet edge, segment the network with VLANs so one infected host can't reach the rest, make sure the host firewall is on with Windows Update via WSUS, run endpoint protection with behaviour-based detection, enforce least privilege so a compromised account can't administer anything, and critically — offline immutable backups with tested restores. Ransomware operators delete backups first, so backups that live on the same network as the server are not a control."
What's the difference between a stateless and stateful firewall?
A stateless firewall looks at each packet's header independently and allows or denies on that alone — fast, but blind to whether the packet belongs to an existing connection. A stateful firewall keeps a table of valid connections and allows return traffic automatically. Return traffic is the thing that actually matters, because stateful is what lets a user browse without also opening inbound ports.