Network security: how firewalls, IDS/IPS and segmentation work

Firewalls control traffic according to rules. IDS detects suspicious activity, while IPS can block it in supported modes. Segmentation restricts unnecessary connections between resource groups. These controls work together when aligned with a clear network design and owned alert handling.

Define required flows before blocking

Map users, servers, equipment and external services. Agree who initiates each connection and why. Without this, rules accumulate through complaints: a temporary allowance remains indefinitely while its purpose is forgotten.

For example, workstations may need an accounting application but not its server administration interface. These require different paths and permissions. Provide a separately controlled administrative route instead of exposing every service to all employees.

Understand observation versus blocking

IDS generally reports matching indicators rather than stopping every suspicious packet. IPS affects traffic and therefore needs false-positive testing. Mode depends on product and placement; a feature name does not prove what it actually does in the network.

Encryption and incomplete coverage can limit visibility. Agree what data the system can see and what conclusions it can support. No alerts do not mean every connection’s full contents were inspected.

Implement changes with a recovery path

Before configuration, retain a supported backup and agree a change window. Access restrictions may disconnect the administrator as well as unwanted traffic. Provide a tested rollback method and management access after an error.

Test new rules against agreed work scenarios. Analyse matches first where an observation mode exists, then enable disruptive actions. Exceptions need a narrow purpose, owner and review date.

Verify denials and ongoing operation

Acceptance covers permitted traffic, blocked unnecessary connections and understandable alerts. Check performance under required load because inspection also consumes resources. Support must distinguish policy blocking from service failure.

Hand over the diagram, rules and response procedure. Review required flows for new applications rather than disabling protection entirely. Periodically review versions and exceptions so business changes do not erode the agreed access model.

Sources and further reading

• Suricata: IDS, IPS and network monitoring
• UniFi: isolation mechanisms

• Related subservice: Network security
• Explore this service area