<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: configuring-network-segmentation
description: >-
  Design and implement network segmentation using VLANs, firewall zones, micro-segmentation, and software-defined networking to contain lateral movement and enforce least-privilege network access.
domain: cybersecurity
subdomain: network-security
tags:
  - vlan
  - segmentation
  - micro-segmentation
  - sdn
  - zero-trust
  - firewall-zones
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1021", "T1570", "T1018"]
  nist-csf: ["PR.AC-5", "PR.DS-2"]
  uuid: 1aba00de-6357-4ce0-9b95-94fc87948aaa
---

# Configuring Network Segmentation

## Overview

Network segmentation is the single most effective control against lateral movement.
Properly segmented networks contain breaches, reduce blast radius, and enforce least-privilege
at the network layer. This skill covers VLAN design, inter-VLAN routing policies, firewall zone
architecture, micro-segmentation with SDN, and verification testing.

Mode: `[MODE: ARCHITECT]` for design; `[MODE: BLUE]` for implementation and hardening.

## Prerequisites

| Requirement | Details |
|---|---|
| Managed switches with VLAN support (802.1Q) | Required |
| Firewall capable of zone-based policies (pfSense, iptables, Palo Alto, Fortinet) | Required |
| Network diagram with asset inventory | Required |
| IP address management (IPAM) plan | Required |
| For micro-segmentation | SDN controller (Cilium, Calico, VMware NSX) |

## Key Concepts

### Zone Architecture

```
VLAN Design:
├── VLAN 10  — Management (10.10.10.0/24)
│   └── Jump hosts, SIEM, patch servers, backup
├── VLAN 20  — Corporate Users (10.10.20.0/24)
│   └── Workstations, printers, internal apps
├── VLAN 30  — Servers (10.10.30.0/24)
│   └── Application servers, databases, file shares
├── VLAN 40  — DMZ (10.10.40.0/24)
│   └── Web servers, mail relay, reverse proxy
├── VLAN 50  — Guest/IoT (10.10.50.0/24)
│   └── Guest WiFi, BYOD, IoT devices
└── VLAN 99  — Quarantine (10.10.99.0/24)
    └── Compromised hosts, investigation sandbox
```

### VLAN Configuration

```bash
# Linux — create VLAN interface
ip link add link eth0 name eth0.10 type vlan id 10
ip addr add 10.10.10.1/24 dev eth0.10
ip link set eth0.10 up

# Cisco-style switch (example)
# interface GigabitEthernet0/1
#   switchport mode trunk
#   switchport trunk allowed vlan 10,20,30,40
#   switchport trunk native vlan 999
```

### Inter-VLAN Firewall Rules (iptables)

```bash
# Default deny between VLANs
iptables -P FORWARD DROP

# Allow corporate → DMZ web only
iptables -A FORWARD -i eth0.20 -o eth0.40 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -i eth0.20 -o eth0.40 -p tcp --dport 80 -j ACCEPT

# Allow servers → management (SNMP, syslog)
iptables -A FORWARD -i eth0.30 -o eth0.10 -p udp --dport 514 -j ACCEPT
iptables -A FORWARD -i eth0.30 -o eth0.10 -p udp --dport 161 -j ACCEPT

# Block guest from everything except internet
iptables -A FORWARD -i eth0.50 -o eth0+ -j DROP
iptables -A FORWARD -i eth0.50 -o wan0 -j ACCEPT

# Allow established/related return traffic
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# Log denied traffic
iptables -A FORWARD -j LOG --log-prefix "SEGMENTATION-DENY: " --log-level 4
iptables -A FORWARD -j DROP
```

### Micro-segmentation (Kubernetes / Cilium)

```yaml
# CiliumNetworkPolicy — restrict pod-to-pod traffic
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: restrict-database-access
spec:
  endpointSelector:
    matchLabels:
      app: postgres
  ingress:
    - fromEndpoints:
        - matchLabels:
            app: api-server
      toPorts:
        - ports:
            - port: "5432"
              protocol: TCP
```

## Workflow

### Step 1: Inventory and Classify Assets

```bash
# Scan network for active hosts
nmap -sn 10.10.0.0/16 -oG hosts_alive.gnmap
# Classify by function: server, workstation, IoT, management
```

### Step 2: Design VLAN Architecture

Map assets to zones based on function, sensitivity, and required communication paths.
Document allowed flows in a matrix.

### Step 3: Implement VLANs and Routing

```bash
# Create VLANs on Linux router
for vlan_id in 10 20 30 40 50 99; do
  ip link add link eth0 name eth0.$vlan_id type vlan id $vlan_id
  ip link set eth0.$vlan_id up
done

# Assign IPs to VLAN interfaces
ip addr add 10.10.10.1/24 dev eth0.10
ip addr add 10.10.20.1/24 dev eth0.20
ip addr add 10.10.30.1/24 dev eth0.30
ip addr add 10.10.40.1/24 dev eth0.40
ip addr add 10.10.50.1/24 dev eth0.50
```

### Step 4: Apply Firewall Policies

Apply inter-VLAN rules with default deny. Test each allowed flow.

### Step 5: Verify Segmentation

```bash
# From corporate VLAN — should reach DMZ:443 only
nmap -sT -p 80,443,22,3306 10.10.40.0/24

# From guest VLAN — should reach nothing internal
nmap -sT -p 22,80,443,3389 10.10.10.0/24 10.10.20.0/24 10.10.30.0/24
```

## Detection

```yaml
title: Network Segmentation Detection
id: 54981cfb-f731-4d07-8a2e-ae5b5020ef4a
status: experimental
description: Detects suspicious activity related to configuring network segmentation techniques in network security context
logsource:
  category: firewall
  product: linux
detection:
  selection:
    Action: blocked
  condition: selection
level: medium
tags:
  - attack.t1021
  - attack.t1570
  - attack.t1018
  - attack.command_and_control
falsepositives:
  - Network monitoring tools performing scheduled connectivity checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Network Segmentation Detection | linux/firewall | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1021, T1570, T1018 |

## Verification

- [ ] All VLANs configured with correct subnets
- [ ] Default deny policy between all VLANs
- [ ] Allowed flows explicitly permitted and documented
- [ ] Guest/IoT network cannot reach internal zones
- [ ] Management network accessible only from authorized hosts
- [ ] VLAN trunking restricted (no VLAN hopping via DTP)
- [ ] Segmentation tested with cross-VLAN port scans
- [ ] Traffic logging enabled for denied inter-VLAN flows

## References

- NIST SP 800-41 Rev 1: Guidelines on Firewalls and Firewall Policy
- CIS Controls v8 Control 12: Network Infrastructure Management
- NIST SP 800-207: Zero Trust Architecture
- MITRE ATT&CK T1021 — Remote Services (lateral movement)
