Networking Fundamentals —
Firewalls, VPNs & Complete Flow

What is a Firewall?

A firewall is a security device or software that controls network traffic. Think of it as a security guard at a building entrance — every packet is checked: Who sent it? Where is it going? Is it authorized? A firewall can Allow (permit traffic meeting rules), Block (reject traffic violating rules), or Log (record traffic for auditing). Without a firewall, everything on your network is exposed directly to the internet.

Types of Firewalls

Firewalls have evolved significantly. A Packet Filtering Firewall checks source IP, destination IP, port, and protocol against static rules — fast but unaware of connection context. A Stateful Firewall tracks active connections and automatically allows legitimate responses back in. A Next Generation Firewall (NGFW) goes further — inspecting applications, users, malware signatures, and website content for deep threat prevention.

What is a VPN?

VPN — Virtual Private Network — is one of the most misunderstood networking technologies. The internet is a public network: your traffic passes through your ISP and many unknown routers before reaching its destination. A VPN creates an encrypted tunnel between your device and a VPN server, hiding the contents of your traffic from anyone in between.

It is called "Virtual" because no dedicated cable exists — the private connection is created logically across the shared public internet. A classic enterprise use case: a bank employee working from home connects via VPN so their laptop behaves as if it were physically inside the office network, accessing internal resources that are otherwise unreachable.

SSH — Secure Shell

SSH provides secure remote command-line access over an encrypted connection. Default port: 22. Before SSH, Telnet was used — but Telnet sent everything in plain text, making credentials trivially interceptable. SSH replaced it entirely. With SSH you can execute commands, manage servers, transfer files, configure systems, and run scripts on a remote machine as if you were sitting in front of it.

FTP — File Transfer Protocol

FTP transfers files between systems on ports 20 (data) and 21 (control). Critical problem: FTP transmits usernames, passwords, and file contents in plain text — anyone intercepting the traffic can read everything. FTP should not be used over untrusted networks.

SFTP — SSH File Transfer Protocol

SFTP runs file transfer over an SSH connection, encrypting everything: usernames, passwords, and all file contents. It has effectively replaced FTP in modern environments. Despite the similar name, SFTP is not FTP-over-SSL — it is a completely separate protocol built on SSH.

SMTP — Simple Mail Transfer Protocol

SMTP is the protocol responsible for sending email. It operates on port 25 (server-to-server), 587 (submission, encrypted), and 465 (SMTPS). The flow: your device → SMTP server → recipient's mail server → recipient's inbox. Critically, SMTP is for sending only. Reading email uses separate protocols: POP3 (downloads and removes from server) or IMAP (syncs across devices).

RDP — Remote Desktop Protocol

RDP — developed by Microsoft — provides complete graphical remote access to a Windows computer on port 3389. Unlike SSH (which gives you a command line), RDP gives you the full desktop UI — exactly as if you were sitting in front of the machine. Your keyboard and mouse input travels to the remote PC; screen updates, audio, and clipboard contents travel back to you. Companies use RDP so employees can access office software, internal applications, and databases remotely.

What is Port Forwarding?

Private IPs (like 192.168.1.20) are not reachable from the internet — they exist only within your local network. Port Forwarding tells the router: "When traffic arrives on Public IP port 80, send it to 192.168.1.20:80." This makes internal services accessible from outside. Common uses: web servers, game servers, CCTV systems, and remote access tools.

MySQL and Port 3306

MySQL is a relational database system that listens on port 3306. In a web application, the flow is: User → Web Server → MySQL (port 3306). The database should never be exposed directly to the internet — only the web server faces public traffic, while MySQL stays protected behind the application layer. Direct exposure creates severe risks: brute force attacks, SQL injection, and data breaches.

End-to-End Journey of Opening Google

Every technology covered across all 5 parts comes together in a single action: typing https://google.com and pressing Enter. The 21-step journey spans the full networking stack — from DNS resolution at the application layer all the way down to electrical signals on the wire, and back up again.

Complete Networking Mental Model

When you open any website, every layer of the stack activates in sequence. Meanwhile, a dozen background technologies coordinate simultaneously — DNS, DHCP, ARP, NAT, TLS, routing — each doing its part invisibly.