Bremen, Germany hashmat@bahadari.de bahadari.de

Infrastructure

Network, Wi-Fi and firewall design

A segmented network with clear firewall zones, secure Wi-Fi and VPN with a second factor.

Firewall zones and rule base
Firewall (NGFW)Default: deny allLAN (VLAN 10)Workstations, printersSERVER (VLAN 20)File, app servers, NASVPNRemote users with MFAWANInternet, Microsoft 365Wi-Fi internal (VLAN 30)WPA3-Enterprise, 802.1XGUEST (VLAN 40)isolated, bandwidth-limitedSourceDestinationAllowedActionLANSERVERFile, print, applicationsallowLANWANWeb (HTTPS), filteredallowWi-Fi internalSERVER, WANsame as LANallowVPNSERVERrequired services onlyallowGUESTWANweb onlyallowGUESTLAN, SERVERno accessdenyanyanyeverything elsedeny

Typical situation

All devices sit on one network, the guest Wi-Fi can reach the servers, and firewall rules have grown over years. Nobody knows exactly what is allowed.

Solution

  1. InventoryRecord devices, services and data flows; produce a network diagram.
  2. SegmentationVLANs for workstations, servers, internal Wi-Fi and guests.
  3. Firewall zonesDefault “deny all”, allowing only required connections between zones.
  4. Wi-Fi and VPNInternal Wi-Fi with 802.1X, isolated guest network, remote access only via VPN with MFA.
  5. DocumentationNetwork diagram, rule set and IP plan as part of the IT documentation.

Benefits

  • An attacker can no longer reach everything
  • Guests stay separated from the company network
  • A traceable, documented rule set

Technical detail

Zone-based policies, IPS and web filtering on the firewall, RADIUS/802.1X for Wi-Fi, SSL VPN with MFA, separate management access.

Let’s talk about your IT.

In a free 30-minute call we clarify where you stand and what’s worth doing.

Book an appointmentSend an email