🚧 धडा 10 — Firewalls, NAT आणि VPNs: फाटक

📍 तुम्ही इथे आहात: 12 पैकी धडा 10 · पुढे: lesson-11-load-balancers-cdn

📦 या ब्रँचमध्ये काय आहे

धडे 01–10. कोण कोणत्या खोलीवर knock करू शकतो: firewall, फाटकावरचे पत्त्याचे भाषांतर (address translation), आणि त्यातून जाणारे बोगदे.

net/demo.py — ports (बंद खोली लगेच नकार देते) आणि route (NAT मागचा तुमचा खाजगी पत्ता)

🧒 5 वर्षांच्या मुलाला समजावल्यासारखे

फाटकाकडे एक यादी असते: पाहुणे खोली 443 वर knock करू शकतात, office मधले कर्मचारी रखवालदाराचे दार 22 वापरू शकतात, नोंदींच्या खोलीत बाहेरून कोणीही येऊ शकत नाही. नियम मोडणाऱ्या लखोट्यांना नकार दिला जात नाही — ते गुपचूप टाकून दिले जातात, म्हणून पाठवणारा वाट पाहत राहतो. फाटक NAT पण करते: आत प्रत्येकाचा खाजगी पत्ता असतो; बाहेर पडताना प्रत्येक लखोट्यावर शाळेचा एकच सार्वजनिक पत्ता पुन्हा लावला जातो आणि कोणी विचारले हे फाटक लक्षात ठेवते, म्हणजे उत्तर परत वाट शोधते. VPN म्हणजे फाटकातून जाणारा बोगदा: घरून असलात तरी तुम्ही "आत" असता.

🗺️ आकृती

flowchart LR
  W["🌍 world"] -->|443 allow| G["🚧 the gate<br/>firewall + NAT"]
  O["🏢 office IP"] -->|22 allow| G
  W -.->|5432 DROP| G
  G --> A["app :443"] ; G --> C["caretaker :22"] ; G -.- D["record room :5432 (inside only)"]

❓ काय

Firewall: (source, destination, port, protocol) वरचे नियम → allow / deny. Stateful: तुम्ही उघडलेल्या connections ची उत्तरे परत येऊ दिली जातात. Cloud security groups म्हणजे प्रत्येक instance साठी stateful allow-lists, default ने deny.
NAT: खाजगी source पत्ते एका सार्वजनिक पत्त्यात बदलतो आणि port-mapping table ठेवतो. आत येणाऱ्यासाठी स्पष्ट port forward लागतो.
Refused विरुद्ध timed out: बंद port लगेच reset पाठवतो; firewall गुपचूप टाकून देतो आणि तुमचा timeout होतो. error च दोषीचे नाव सांगते.
Tunnels: ssh -L local:host:port एक खोली फाटकातून नेतो; VPN तुमचे संपूर्ण machine नेतो.

🤔 का

deploy नंतरच्या बहुतेक "connect होत नाही" incidents मागे एक न जोडलेला नियम असतो, किंवा चुकीच्या wing ला जोडलेला. Least privilege — 443 सर्वांना, 22 फक्त तुम्हाला, database फक्त app च्या subnet ला — ही पाच ओळींची policy बहुतेक घुसखोरी रोखते.

🔧 कसे (या repo मध्ये)

ports() मधला connect_ex बंद खोल्यांसाठी लगेच परत येतो; timeout 3 s ठेवा आणि firewall मागचा host वापरून पाहा म्हणजे फरक जाणवेल.

🧪 करून पाहा

python3 net/demo.py ports                               # closed rooms answer fast
nc -zv -w 3 example.com 8443 ; echo "exit $?"           # a port the gate drops: ~3 s, then timed out
nc -zv -w 3 example.com 443                             # the allowed room: succeeded
ssh -L 15432:db.internal:5432 bastion.example -N &      # (if you have one) a tunnel: localhost:15432 is now the record room

✅ तपासा — तुम्हाला काय दिसायला हवे

बंद local ports: लगेच closed. example.com वर 8443: तीन seconds ची वाट आणि मग timeout — फाटक. 443: succeeded!. Refused जलद, dropped हळू: पूर्ण निदान हेच.

🏁 तुम्ही आत्ताच काय सिद्ध केले

failure च्या आकारावरून तुम्ही रिकामी खोली आणि कुलूपबंद फाटक यांतला फरक ओळखू शकता, आणि तुमच्या laptop चा पत्ता internet वर कधीच का दिसत नाही हे समजावू शकता.

⚠️ नेहमीच्या चुका

port 22 किंवा 5432 वर "तात्पुरते" 0.0.0.0/0. Bots ते काही मिनिटांत शोधतात.
security group कधी update झालाच नव्हता, आणि तासभर app debug करत बसणे.
"VPN च्या आत" म्हणजे विश्वासू असे मानणे. चोरलेला laptop सुद्धा आत असतो (trade-offs चे पान पाहा).

🏭 प्रत्यक्ष वापरात हे का महत्त्वाचे: security groups, NACLs, WAFs आणि zero-trust proxies म्हणजे वेगवेगळ्या layers वरचे हेच फाटक; "misconfigured rule" असलेला प्रत्येक cloud outage चा post-mortem म्हणजे हाच धडा.

⏭️ पुढे

धडा 11 — load balancers, proxies आणि CDNs: अनेक खोल्यांसमोरचा स्वागत कक्ष, आणि वाचकाजवळची प्रत.

🚧 Lesson 10 — Firewalls, NAT & VPNs: the gate

📍 You are here: Lesson 10 of 12 · Next: lesson-11-load-balancers-cdn

📦 What's in this branch

Lessons 01–10. Who may knock on which room: the firewall, the address translation at the gate, and tunnels through it.

net/demo.py — ports (a closed room refuses fast) and route (your private address behind NAT)

🧒 Explain like I'm 5

The gate has a list: visitors may knock on room 443, staff from the office may use the caretaker's door 22, nobody may enter the record room from outside. Envelopes that break the rule are not refused — they are silently dropped, so the sender waits and waits. The gate also does NAT: inside, everyone has a private address; leaving, every envelope is re-labelled with the school's one public address and the gate remembers who asked so the reply finds its way back. A VPN is a tunnel through the gate: from home, you are "inside".

🗺️ Diagram

flowchart LR
  W["🌍 world"] -->|443 allow| G["🚧 the gate<br/>firewall + NAT"]
  O["🏢 office IP"] -->|22 allow| G
  W -.->|5432 DROP| G
  G --> A["app :443"] ; G --> C["caretaker :22"] ; G -.- D["record room :5432 (inside only)"]

❓ What

Firewall: rules on (source, destination, port, protocol) → allow / deny. Stateful: replies to connections you opened are allowed back. Cloud security groups are stateful allow-lists per instance, deny by default.
NAT: rewrites private source addresses to a public one and keeps a port-mapping table. Inbound needs an explicit port forward.
Refused vs timed out: a closed port sends a reset immediately; a firewall drops silently and you time out. The error names the culprit.
Tunnels: ssh -L local:host:port carries one room through the gate; a VPN carries your whole machine.

🤔 Why

Most "cannot connect" incidents after a deploy are a rule that was not added, or one added to the wrong wing. Least privilege — 443 to everyone, 22 to you, the database to the app's subnet only — is a five-line policy that prevents most breaches.

🔧 How (in this repo)

connect_ex in ports() returns immediately for closed rooms; set the timeout to 3 s and try a firewalled host to feel the difference.

🧪 Try it

python3 net/demo.py ports                               # closed rooms answer fast
nc -zv -w 3 example.com 8443 ; echo "exit $?"           # a port the gate drops: ~3 s, then timed out
nc -zv -w 3 example.com 443                             # the allowed room: succeeded
ssh -L 15432:db.internal:5432 bastion.example -N &      # (if you have one) a tunnel: localhost:15432 is now the record room

✅ Verify — what you should see

Closed local ports: closed instantly. 8443 on example.com: a three-second wait then a timeout — the gate. 443: succeeded!. Refused is fast, dropped is slow: that is the whole diagnostic.

🏁 What you just proved

You can tell an empty room from a locked gate by the shape of the failure, and explain why your laptop's address never appears on the internet.

⚠️ Common mistakes

0.0.0.0/0 on port 22 or 5432 "temporarily". Bots find it in minutes.
Debugging the app for an hour when the security group was never updated.
Believing "inside the VPN" means trusted. A stolen laptop is inside too (see the trade-offs page).

🏭 Why this matters in production: security groups, NACLs, WAFs and zero-trust proxies are this gate at different layers; every cloud outage post-mortem with "misconfigured rule" is this lesson.

⏭️ Next

Lesson 11 — load balancers, proxies & CDNs: the reception desk in front of many rooms, and the copy near the reader.

← Previousrouting Next →load balancers cdn

This page is the lesson's README from the lesson-10-firewalls-nat-vpn branch, shown here so the whole School stays on one site. Code files open on GitHub at the same branch.