Network › Module 1 › Lesson 2
Host Firewalls vs Network Firewalls
YOUR OS firewall is not the same box as the building's edge — then read YOUR profiles.
Visual · host_vs_network_firewall
Host firewall sits on the endpoint. Network firewall sits on a path.
Opening
Two boxes, two jobs: the laptop's filter and the path's filter are not interchangeable.
Lesson 1 named packet policy. This lesson splits where that policy can live. A host firewall (Windows Defender Firewall, nftables/ufw, pf) sits on the computer you are using. A network firewall sits on a path — a home gateway, an office edge, a cloud security group in front of a VPC. They can both be right, both be empty, or disagree. Attackers love the disagreement: the edge allows 443, the host still listens on 3389 “for convenience.” Original Cyberlium. DEMO http://192.168.0.1/ is YOUR lab app.
1. Host firewall: policy that travels with the device
When a laptop leaves the office, the building firewall stays behind. The host firewall is the policy that still applies on a hotel network. That is why “I turned it off because a game needed a port” is a lasting injury: the next café does not get a vote. On Windows, profiles (Domain, Private, Public) try to pick a posture from network class. On Linux, ufw/nftables/iptables are the common names. You will query YOUR profiles. You will not disable them to make a screenshot prettier.
Command guide
Host firewall: policy that travels with the device
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install ufw sudo apt install dnsutils
macOS: Use pfctl (built-in)
Windows: Use: netsh advfirewall Use nslookup (built-in)
═══ COMMANDS ═══
Command — copy this
uname -a || ver (sudo -n ufw status verbose ) || ufw status powershell.exe -NoProfile -Command "Get-NetFirewallProfile | Select-Object Name,Enabled | Format-Table -AutoSize"
2. Network firewall: policy on a path you may not own
A network firewall sees traffic that crosses it. It cannot see a USB malware copy that never uses that path. It also cannot save you if the host publishes a service on an interface the edge never filters. Cloud security groups are network firewalls with API buttons. You may administer a home gateway you own. You may not “practice” by changing a campus firewall, a hotel controller, or a roommate's mesh node. ; if it is the home router admin page, STOP — that is not this lesson's toy.
3. Defense in depth is two yeses, not one maybe
Host plus network is defense in depth only if both actually deny the forgotten flows. One “allow any” box plus one strict box is just the strict box plus extra latency. Record which box you can actually change: today, YOUR host.
Command guide
Defense in depth is two yeses, not one maybe
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3 sudo apt install dnsutils
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/ Use nslookup (built-in)
═══ COMMANDS ═══
Command — copy this
python3 - << 'PY'
import socket
for port in (8780, 22, 3389):
s = socket.socket(); s.settimeout(0.4)
r = s.connect_ex(("127.0.0.1", port))
s.close()
print(f"127.0.0.1:{port} ->", "LISTEN_OR_OPEN" if r==0 else f"closed_or_filtered({r})")
print("do not probe other LAN IPs")
PY4. What you ship: host policy you can prove, path policy you are authorized to touch
Prove YOUR host firewall is enabled on the profile you actually use. Do not treat a building firewall as your lab. Do not disable host firewalls “for Cyberlium.” Bind teaching servers to 127.0.0.1 only.
5. What you record before the next lesson
Date. Host vs network firewall one line each. YOUR profile enabled? DEMO identified/STOP. SAFE NEVER LAN nmap. File t11-m01-l02-host-vs-net.txt chmod 600.
6. Wrong vs right: stranger networks vs literacy on systems you own
Worked failure — same network word, opposite target. Right never needs a café or campus LAN.
Wrong
Turn off Windows Firewall because a screenshot looked cleaner. Change a school edge ACL “as practice.” Scan the LAN for other firewalls.
Right
List YOUR firewall profiles. Write host vs path in cyberlium-lab. Leave other people's boxes alone. Next: Default Deny and Allowlists.
Mission: read YOUR host firewall, not the building's
1) / STOP if router. 2) Run the host-firewall status command for YOUR OS. 3) Write one sentence: host vs network firewall. Do not disable the firewall. Do not touch campus gear.
Stuck? Ask Cyberlium AI Mentor
Mentor hint: “How do I show firewall profiles on Windows 11 / Ubuntu without sudo?” — not “how do I bypass the café login.”
Knowledge Check
APPLY: A hotel network has no “office firewall.” What still travels with your laptop?
Multiple choice
Knowledge Check
APPLY: True or False: A cloud security group is a kind of network firewall.
True or False
Knowledge Check
APPLY: Edge allows 443, host still listens on 3389 inbound. What failed?
Multiple choice