104 Digital Life Security #8: Your Home Network — What Actually Happens When You Connect?

Digital Life Security Series ...Practical ways to protect your devices, accounts, privacy, information and home

You open your laptop.

It connects to Wi-Fi.

You open a browser and visit a website.

A second later, the page appears.

It seems simple.

Behind that simple action, however, several different systems have just worked together.

Your device joined a network.

It received an address.

It discovered how to reach other networks.

It asked another system where the website could be found.

Information was divided into packets.

Those packets traveled through networking equipment and across the internet.

Other packets came back.

Understanding this process is the beginning of understanding network security.

Your Internet Connection Is Not Your Network

These two ideas are easy to combine in our minds.

Your internet connection connects your location to an internet service provider.

Your local network connects devices within your home, business, shop, or property.

At Zehr Estate and Zehr Escape, for example, the outside internet connection is fiber.

Zehr Retreat does not currently have fiber available.

But that difference does not change many of the fundamental principles of the local networks inside those properties.

Computers, phones, printers, televisions, cameras, and other devices still need a way to communicate.

Fiber Is the Road Coming to the Property

Fiber-optic internet carries information using light through optical fiber.

Instead of electrical signals traveling through copper wire, information can travel as optical signals.

Fiber can provide enormous bandwidth over considerable distances and has become an important technology for modern internet infrastructure.

But your laptop probably does not have a fiber-optic cable plugged directly into it.

Something has to connect the provider's fiber network to the equipment inside the property.

Meet the ONT

Fiber installations commonly include a device called an ONT, or Optical Network Terminal.

The ONT provides the boundary between the provider's optical network and the customer's networking equipment.

Depending on the provider and installation, the ONT may be a separate device or some functions may be combined with other equipment.

For our simplified network, we can picture:

Internet → Fiber → ONT → Router → Local Network

Already we can see that “the internet” and “our network” are separate pieces connected together.

The Router Is the Traffic Director

The router is one of the most important devices on a typical home or small-business network.

Its basic job is contained in its name.

It routes traffic between networks.

Your local network is one network.

Your internet provider connects you toward many other networks.

The router helps determine where network traffic should go.

When your computer needs to communicate with something outside your local network, the router is normally its path outward.

The Router Is Often Several Devices in One Box

Consumer networking equipment can make terminology confusing because one physical box may perform several jobs.

A device we casually call “the router” may contain:

In larger or more advanced networks, many of these functions may be handled by separate devices.

Understanding the functions separately makes networking much easier to understand.

What Does a Switch Do?

Suppose you have several wired devices.

A desktop computer.

A printer.

A server.

A network camera.

Another switch in an outbuilding.

An Ethernet switch allows devices on the local network to communicate through wired Ethernet connections.

Modern switches learn which devices are reachable through their ports and forward Ethernet frames where they need to go.

This is different from the router's job.

A simplified distinction is:

A switch connects devices within a network.

A router connects different networks.

That distinction will become very important when we start dividing a network into security zones.

Where Does Cat 6 Fit?

Cat 6 is the physical copper cabling that can carry Ethernet between network devices.

It is infrastructure.

A Cat 6 cable might connect:

The cable itself does not decide where packets go.

It provides the physical pathway over which network communication can travel.

This is one reason installing network cable while a property is already being opened up for other infrastructure can be so valuable.

The physical pathway may serve technologies that have not even been installed yet.

Wi-Fi and Ethernet Lead to the Same Network

People sometimes think of Wi-Fi as the network and Ethernet as something different.

They are different methods of connecting devices, but they can lead into the same local network.

A laptop may communicate wirelessly with an access point.

A desktop computer may communicate over Cat 6.

Both may eventually reach the same switch, router, internet connection, server, or printer.

For security purposes, the important question is not simply:

Is it wired or wireless?

It is also:

What network is this device actually allowed to reach?

Every Network Device Needs an Identity

For devices to communicate, the network needs ways to identify where information is going.

Two addresses we encounter frequently are:

MAC addresses and IP addresses.

They serve different purposes.

What Is a MAC Address?

A network interface typically has a link-layer identifier known as a MAC address.

Ethernet switches use MAC addresses when forwarding traffic on a local Ethernet network.

You might think of this as an identifier used relatively close to the hardware and local network.

But do not think of a MAC address as a trustworthy personal identity.

MAC addresses can sometimes be changed or randomized.

Modern devices may deliberately use randomized MAC addresses for privacy, particularly on Wi-Fi networks.

Again:

An identifier is not necessarily proof of identity.

What Is an IP Address?

An IP address identifies an interface for communication using the Internet Protocol.

On a typical home network, you may see private IPv4 addresses resembling:

192.168.1.25

or:

10.0.0.42

These addresses can be used within private networks.

Your router also has connectivity toward the outside world, where public addressing and your internet provider come into the picture.

IPv6 provides a much larger address space and operates differently in some important respects, but the fundamental idea remains:

Devices need addressing so network traffic can reach the appropriate destination.

Who Gives Your Computer Its Address?

You usually do not type an IP address into your phone every time you arrive home.

Something does that work automatically.

On many networks, that something is DHCP.

DHCP stands for Dynamic Host Configuration Protocol.

When a device joins the network, DHCP can provide configuration information such as:

On a typical home network, the router often provides DHCP service.

The Default Gateway Is the Way Out

Your computer can communicate directly with devices it recognizes as being on its local network.

But what happens when it needs to reach a server somewhere on the internet?

It sends that traffic toward its default gateway.

On a simple network, the default gateway is normally the router.

You can think of it as:

“If the destination isn't here, send it this way.”

Then We Need DNS

You type:

example.com

Computers ultimately need network addressing information rather than simply the name you remember.

The Domain Name System, or DNS, helps translate domain names into the information computers need to locate internet services.

DNS is one of the fundamental systems that makes the internet usable.

Without it, we would spend much more time dealing directly with network addresses.

We Have Already Met DNS

DNS should sound familiar.

In our email security discussions, we learned that SPF, DKIM, and DMARC rely on information published through DNS.

Now we see DNS appearing again in ordinary network communication.

This is one of the exciting things about learning cybersecurity.

The pieces start connecting.

Email security, website security, networking, certificates, and authentication are not isolated subjects.

They depend upon many of the same underlying systems.

What Is NAT?

Many traditional IPv4 home networks use Network Address Translation, or NAT.

Inside the network, devices use private IP addresses.

When they communicate with the internet, the router translates those connections so multiple internal devices can share outside connectivity.

Imagine several devices:

192.168.1.10
192.168.1.11
192.168.1.12

All three may access the internet through the router's external connection.

The router keeps track of the active translations so returning traffic can be delivered to the correct internal device.

NAT Is Not the Same Thing as a Firewall

This distinction is worth learning early.

NAT and firewalling often occur in the same router, and the practical behavior of a typical home router can make the two seem like the same thing.

They are not.

NAT translates network addressing.

A firewall applies rules controlling network traffic.

They may work together, but they solve different problems.

Separating these concepts will become important when we begin studying firewall rules.

What Does the Firewall Do?

A firewall examines network traffic and applies rules determining what communication should be allowed or blocked.

For example, a typical network may allow devices inside the network to initiate connections toward the internet while rejecting many unsolicited connection attempts arriving from outside.

More advanced firewall policies can control communication based on:

A firewall is not magic protection.

It is a system for enforcing network communication rules.

What Is a Port?

Network ports can be confusing because we also use the word port for physical connectors.

In TCP/IP networking, a port is a logical number associated with network communication.

Different services commonly listen for connections on particular ports.

For example:

80 has traditionally been associated with HTTP.

443 is commonly associated with HTTPS.

22 is commonly associated with SSH.

A useful simplified model is:

The IP address helps identify the destination system, while the port helps identify the service being contacted on that system.

What Is a Packet?

When information travels across an IP network, it does not normally travel as one enormous continuous object.

Data is divided and encapsulated into manageable units for transmission.

At the IP layer, we commonly talk about packets.

Other layers use terms such as frames and segments, depending upon exactly which part of the communication process we are discussing.

This layered terminology may seem unnecessarily technical at first.

Later, it becomes extremely useful when troubleshooting or investigating network problems.

A Web Page Is Really a Conversation

Let's put some of these pieces together.

You enter a website address into your browser.

A simplified sequence might look something like this:

1. Your computer is already connected to Ethernet or Wi-Fi.

2. DHCP has helped configure its network settings.

3. The computer uses DNS to determine where the requested website can be reached.

4. Traffic destined outside the local network is sent toward the default gateway.

5. The router and firewall process the connection.

6. The traffic travels through your internet provider and other networks.

7. The destination server responds.

8. Return traffic finds its way back through the networks and router to your computer.

9. Your browser processes the response and displays the page.

And that is still a greatly simplified version.

Packets Do Not Need to Know About Your Web Page

This introduces an important networking concept.

Different layers of the system perform different jobs.

An Ethernet switch does not need to understand the meaning of the article you are reading.

A router does not need to understand the photograph on a web page.

DNS does not need to render the page.

Each component handles its part of the communication.

This separation into layers is one reason enormously complicated networks can work.

And It Helps Us With Security

When something goes wrong, we can begin asking where the problem exists.

Is the Ethernet link working?

Did the device receive an IP address?

Can it reach the gateway?

Is DNS resolving the name?

Is a firewall blocking the connection?

Is the remote server responding?

Is HTTPS working correctly?

Instead of saying:

“The internet isn't working.”

we can start determining which layer isn't working.

That is both a networking skill and a security skill.

Now Think About a Network Camera

Suppose we add a security camera.

The camera is no longer simply a camera.

It is a computer connected to the network.

It may have:

Suddenly the concepts we have been learning become very practical.

Should the Camera Reach Everything?

Imagine a camera mounted on an outbuilding.

Does that camera need to communicate directly with your personal computer?

Your printer?

Your file server?

Every phone in the house?

Perhaps not.

This brings us back to least privilege.

A network device should ideally have access to the systems it needs in order to perform its job and no more than necessary.

That leads directly to one of our future topics:

network segmentation.

One Physical Network Can Contain Multiple Logical Networks

This is where networking becomes especially interesting.

Installing Cat 6 does not mean every device attached to that cabling must have unrestricted access to every other device.

Managed networking equipment can create separate logical networks over shared physical infrastructure.

For example, we might eventually have:

Rules can then control which networks are allowed to communicate with one another.

This is where switches, routers, VLANs, and firewalls begin working together as a security architecture.

The Cable Is Only the Beginning

This is worth remembering when installing new network infrastructure.

A Cat 6 cable is a physical pathway.

The security design comes from what we connect to it and how the networking equipment is configured.

A well-planned wired infrastructure gives us options.

We can change switches.

Add access points.

Add cameras.

Create separate networks.

Change firewall rules.

Add monitoring.

The cable installed today can support a much more sophisticated network tomorrow.

Know What Is Connected

One of the simplest network-security practices is also one of the most valuable:

Know what devices are on your network.

Routers and network-management systems often provide lists of connected devices.

Look through them occasionally.

You may find:

If you do not recognize something, investigate it.

You cannot effectively protect a network if you do not know what is connected to it.

This Is Asset Inventory

Security professionals often use the term asset inventory.

An asset is something of value that needs to be managed or protected.

Computers are assets.

Servers are assets.

Routers are assets.

Cameras are assets.

Data is an asset.

Accounts can be assets.

Knowing what you have is one of the first steps toward protecting it.

This principle scales from a home network to a large organization.

A Practical Network Checkup

Take a look at your own network and see whether you can answer these questions:

Draw Your Network

Here is a surprisingly useful exercise.

Take a piece of paper and draw the network.

Start with:

Internet

Then draw:

ONT or modem

Then:

Router / firewall

Then add:

Switches → access points → computers → printers → servers → cameras → other devices

Do not worry about making a perfect engineering diagram.

The goal is to understand what connects to what.

Once you can draw the network, you are beginning to understand the network.

And Once You Understand It, You Can Secure It

This is why network security should not begin with buying a firewall or installing security software.

It begins with understanding the system.

What equipment do we have?

What is connected?

How does traffic move?

Which devices need to communicate?

Which devices should not communicate?

Where does the internet enter?

Where are the boundaries?

Those questions allow us to design security intentionally rather than simply adding security products afterward.

We Have Entered the Network

Our Digital Life Security series started with the person sitting in front of the computer.

Then we looked at browsers.

Email.

Email headers.

Authentication.

Phones.

Text messages.

Now we have stepped behind those devices and begun looking at the infrastructure connecting everything together.

We have met:

Fiber.

ONTs.

Routers.

Switches.

Ethernet.

Wi-Fi.

MAC addresses.

IP addresses.

DHCP.

DNS.

NAT.

Firewalls.

Ports.

Packets.

And network segmentation.

That sounds like a lot.

But all of it comes back to a fairly simple question:

Who should be allowed to communicate with whom?

That question is at the heart of network security.

Home
Brad Zehr | Zehr.net | brad@zehr.net

About Services Why A Site Site Ideas Topics Podcast Help Contacts

Topics, Podcast & Images on this site are AI Assisted.

Search Contact Home