Understand and test firewall policy
Learn how traffic is evaluated, compare control locations, document one rule, and verify an allowed case plus a blocked case.
Firewall and Network Security Learning Center
Build practical security judgment in a useful order. Choose one outcome, learn the boundary and evidence behind it, complete a small practice task, and finish with a result you can verify.
Choose a learning path by the result you need
This is a curriculum, not another copy of the topic directories. Each path has a starting concept, a practical decision, and a finish line you can check.
Build a maintainable home network
Move from router administration and device inventory to meaningful trust zones, recovery planning, and boundary tests.
Respond to suspicious activity
Separate a message, credential event, executed file, and confirmed compromise so containment matches the evidence.
Use network tools without overclaiming
Interpret a port, calculate a range, draft a rule, and understand what an external reachability check can and cannot prove.
Record four facts before you study
A guide becomes useful when you can connect it to a real boundary, device, or event. Write these facts down before changing a setting.
| Fact | Question to answer | Why it matters |
|---|---|---|
| Asset and owner | Which device, account, service, or network is involved, and who is responsible for it? | A recommendation without an owner is difficult to approve, maintain, or remove. |
| Current state | What version, route, listener, rule, permission, or observed event exists now? | You need a baseline to distinguish a real change from an assumption. |
| Boundary | Which source should reach which destination, and from what network position? | Security controls act at specific points and may not see the traffic you expect. |
| Finish line | What should work, what should fail, and what evidence will show both? | A visible result is stronger than a setting that merely looks correct. |
Learning path: understand and test firewall policy
Learn the traffic decision first, choose the control location second, and finish by proving both the intended allow and deny outcomes.
Begin with the decision process
Read how firewalls evaluate traffic to distinguish packet direction, state, application identity, and return traffic. Your first exercise is to describe one communication as source, destination, protocol, service, and direction without naming a product.
Choose where the control belongs
Use the software firewall selection guide for a single device and the hardware firewall guide for a shared gateway. Compare what each control can observe, who maintains it, how it logs decisions, and how the original state can be restored.
Finish with evidence
Draft the communication in the firewall rule planner, then follow the controlled firewall testing workflow. Completion means you can show one expected connection that succeeds, one out-of-scope connection that fails, and the log or observation that supports each result.
Learning path: build a maintainable home network
Secure and document the router before adding zones, then test one useful separation without breaking the communication the household needs.
Establish an operable router
Start with the home router security checklist. Record the model, hardware revision, firmware, administrator access path, backup method, connected-device list, and support status. The practice task is to recover the configuration record without changing live settings.
Map communication before creating zones
List trusted computers, work devices, guests, and smart-home equipment. For each group, state whether it needs the internet, local discovery, printer access, or administration. The home network segmentation guide turns that inventory into an access matrix instead of assuming every smart device needs a separate network.
Finish with a boundary test
Choose one low-risk separation, such as blocking a guest device from a trusted computer while retaining internet access. Completion means the allowed task still works, the restricted path fails, and you know how to restore the previous configuration.
Learning path: respond according to evidence
Classify what happened, protect a clean recovery path, and define the evidence that will show accounts and devices are ready to use again.
Classify the event before acting
Use the phishing response path to distinguish seeing a message, opening a page, entering credentials, and running a file. Write the observed facts without labeling the device compromised unless stronger evidence supports that conclusion.
Protect the clean recovery path
If credentials may be exposed, use a known-clean device to secure primary email, recovery methods, active sessions, and strong authentication. If unknown software executed, preserve alert details and isolate the affected device when continued connectivity creates risk. The spyware evidence guide explains why personal-safety situations may require a different sequence.
Finish with verification
Completion means the important accounts have known recovery methods, suspicious sessions are revoked, the affected device has a documented recovery decision, and monitoring has a defined period. One scan or password change is not the finish line for every incident.
Learning path: use tools as evidence inputs
Use each tool to answer one bounded question, then verify its output against the real process, route, owner, or policy before making a change.
Port reference
Use the TCP and UDP port reference to find a registered service clue. Finish by identifying the real listening process and network path rather than treating the number as proof.
Subnet calculation
Use the IPv4 and IPv6 subnet calculator to find exact boundaries. Finish by comparing the result with interface, DHCP, route, and firewall objects.
Rule planning
Use the rule planner to turn a verbal request into review fields. Finish with an owner, purpose, expiry, rollback, allowed test, and blocked test.
External reachability
Use the limited external port scan only for its fixed observed address and selected TCP scope. Finish by confirming the responsible service and whether public access is intended.
How to know when a path is complete
You should be able to explain the boundary in plain language, identify the evidence behind the decision, name a safe rollback, and show a result that should pass plus one that should fail. If any part is missing, return to the most specific guide instead of adding another tool or product.