Firewall understanding help.

[Dial-up King]

Correct me if I'm wrong on any of this.
My understanding of usual network infrastructure is you have "zones" and anything behind those zones is usually trusted (or untrusted if, for example, a guest network) by everything else in that zone. Then those zones are separated by firewalls that control how traffic may flow between the zones.

However, as far as I can tell this game only really has 3 zones: Producers, Consumers, and your servers/other gear

Am I looking at this incorrectly or is the idea of the game to not wire everything into one GIANT network, and instead study the different producers and consumers and find which ones can pair up directly and wire them up accordingly into smaller physical networks?

Another question I have is can ANY client (producer or consumer) have malicious activity or is it only one of the two I have to worry about?

[nobodx]

Firewalls in this game don't work with zones, only allow/deny certain packets, sender or reciever (or any combination of that)

As far as i've seen till now, only users start malicious actions and only 2 are available for now
a worm that installs itself on every network-component with a random name.
it propagades by using Traffic TCP/510-519
- it will send random packets, spreading itself further and blocking bandwith for other users
and a attack from a single User by using TCP/8000-8099

at least the worm will be anounced a day or two before spreading from a user - you also get 2 floors where it might start

Firewalls in this game block/allow any traffic going through them depending on the rules

firewall allow traffic tcp/23 from @debugger to @firewall on @firewall

will make sure your firewall won't block you accessing it from your @debugger

firewall default deny

will block anything not explicitly allowed

[Dial-up King]

Originally posted by nobodx:

Firewalls in this game don't work with zones, only allow/deny certain packets, sender or reciever (or any combination of that)

As far as i've seen till now, only users start malicious actions and only 2 are available for now
a worm that installs itself on every network-component with a random name.
it propagades by using Traffic TCP/510-519
- it will send random packets, spreading itself further and blocking bandwith for other users
and a attack from a single User by using TCP/8000-8099

at least the worm will be anounced a day or two before spreading from a user - you also get 2 floors where it might start

Firewalls in this game block/allow any traffic going through them depending on the rules

firewall allow traffic tcp/23 from @debugger to @firewall on @firewall

will make sure your firewall won't block you accessing it from your @debugger

firewall default deny

will block anything not explicitly allowed

I appreciate the response and the help.
I might have been unclear. I meant zones as more of a concept and you can still VAGUELY do them in this game as long as you make sure the traffic HAS to go through a firewall when going between "zones". The firewall is a WALL between the zones that dictates the kinds of traffic allowed to traverse the network.
I'm just trying to figure out if I'm overthinking the complexity in terms of this game as I only really see 3 total zones (consumers, producers, and your infrastructure).
If what you say is true and only consumers are malicious, then theoretically you only need to put them on a untrusted zone on one side of a carefully networked firewall and everything else could sit on the other side. That side being sort of a trusted zone.

I thought the tutorial on the firewall unit was a little confusing even as someone who does basic IT work as a job. Don't get me wrong, it explained mostly how to get one working, but it just kind of said, "here's a bad user. Look at the bad traffic. Here's a firewall. Plug some stuff in differently. Deny/allow some traffic. Look, no more bad traffic."
I feel like it could use a little more depth and maybe that's currently caused by game limitations since there is only two types of attacks.

[Shabazza]

It's a good idea to separate producers from consumers and separate both from your data center infrastructure with FWs, to prevent worms ect. from affecting your HW or producers.
So I use FWs to/from my DSs and each producer gets it's own FW.

So, technically a "3 zones" structure.
But after the producer's FW, I mix PROD and CONS on switches.
I see no benefit keeping those religiously separated to funnel them through 1 switch grid.

Kind of like this in a segment (omitting showing routers):

 Producer <> FW <>
Consumers <> FW <>
                  Floor Switch (Mixes both) <> Segment Switch <> FW <>
                  Data Center sub net x

You could double up FWs after a segment, to create a DMZ (Demilitarized zone) - but again - I see no benefit with the kind of services we have.

But don't play a boring "meta". Tinker.

[nobodx]

as soon as possible, i jailbreak the firewall-software and put it on my routers to seperate even the towers main-line from any endpoints ;)

[Soylent]

Don't routers do the same thing as firewalls? For example plug the DNS server into a router and just add a traffic route for udp/53. Wouldn't that block the worm?

[Heri]

Originally posted by Soylent:

Don't routers do the same thing as firewalls? For example plug the DNS server into a router and just add a traffic route for udp/53. Wouldn't that block the worm?

The worm will still spread to and run on your router.

[Shabazza]

Originally posted by Heri:

Originally posted by Soylent:

Don't routers do the same thing as firewalls? For example plug the DNS server into a router and just add a traffic route for udp/53. Wouldn't that block the worm?

The worm will still spread to and run on your router.

Exactly.
That's why you basically need to form a DMZ (or several) with firewalls.
And only there should other devices like segment routers/servers/floor routers exist.
A sanitized zone between "dirty" consumers and everyone else.

Example[imgur.com]

Image has 4 FWs, when 3 would be suficient to illustrate it.
But AI apparently likes right angles, lol.

For the OP: Switches are not susceptible to worms. Those can be used anywhere.

[Dial-up King]

Isn't one firewall at the edge of problematic zones enough since worms can't propagate through firewalls?
Unsafe Zone -> firewall -> Trusted Zones
I can see benefits of a DMZ in a normal system maybe, but in this game that seems unnecessary. I'm also not terribly deep into the game yet.

[Shabazza]

Currently, worms ect. can only emerge from consumers.
So as long as you keep those behind a firewall, you should be good.
But as you not only have 1 such zone border, but many zones that touch somewhere, you will most likely end up with something like in my image.
Where zones (formed by firewalls) form a pristine zone between them, which gets routed through.
(I even mark that with a different cable color, so I know I can use any device from that point on)

Yeah, you could get rid of special data center or producer FWs, but for realism's sake and future-proofing, I build those as well.
Makes me sleep better, as the game may be updated at some point to have producers also be a point of ingress for bad stuff.

[nobodx]

currently i'm running 3 firewalls, one on the user router, one on the corporate router, and one on my server-router
two of them are currently more or less useless - bur who knows, maybe we'll get a corporation-virus someday

[Soylent]

do you have to use both ports on the firewall for it to work?

[nobodx]

internally the hardwae-firewall acts like a normal switch everything going in one port goes out all the other - so yes, you neet to use at least 2 ports

(unless you use vlans, then it should be possible to sent it back on the same port... probalby)