Networking Fundamentals: IP, Ports, DNS and Firewalls | Free Cybersecurity Course: Protect Your Data, Devices and Business

What you'll learn

How data travels across a network in packets, and what IP and MAC addresses are.
The difference between public and private IP addresses, and how NAT connects them.
What ports and protocols are, and which ones should never be exposed to the internet.
How DNS turns names into addresses, and why it matters for security.
How firewalls and network segmentation protect a small office, with a real rule table.

You don't need to be a network engineer to work in cybersecurity, but you do need to speak the language. Almost every alert, log entry and security report mentions IP addresses, ports, DNS or firewall rules. This lesson gives you the core vocabulary in plain English: how a request from your laptop reaches a website and comes back, where security controls sit along that path, and how a small law office in Boise closed the most dangerous hole in its network in an afternoon.

≈4.3 billionpossible IPv4 addresses (2³²), which is why private addresses and NAT exist

65,535TCP ports per address; a well-run office exposes only a handful to the internet

Default denythe starting rule for inbound traffic on any firewall you manage

Follow a packet
Read IP addresses
Understand ports
See how DNS works
Write firewall rules

How data travels: packets and layers

When you open a website, your request is chopped into small pieces called packets. Each packet carries a header (like an envelope with "from" and "to" addresses) and part of the data. Routers along the way read the header and pass the packet toward its destination, where the pieces are reassembled.

Networking is organized in layers, each with its own job. You'll hear about the seven-layer OSI model and the simpler four-layer TCP/IP model. For security work, this simplified view is enough:

Layer (TCP/IP)	What it does	Examples	Security controls here
Application	The data apps actually exchange	HTTPS, DNS, email (SMTP, IMAP)	Web filtering, email security, web application firewalls
Transport	Delivers data to the right program, reliably or quickly	TCP, UDP, ports	Firewall rules by port
Internet	Addresses and routes packets between networks	IP addresses, routers	Firewall rules by address, segmentation
Link	Moves data on the local network	Ethernet, Wi-Fi, MAC addresses	Wi-Fi encryption, port security on switches

TCP sets up a connection and makes sure every packet arrives in order, which suits web pages and email. UDP just sends packets without checking, which is faster and suits video calls, online games and most DNS lookups.

IP addresses: public, private and NAT

An IP address identifies a device on a network. The common version, IPv4, is written as four numbers from 0 to 255, like 192.168.1.20. It has 32 bits, so there are only 2³², about 4.3 billion, possible addresses, far fewer than the devices in the world. IPv6 uses 128 bits and is written in hexadecimal, like 2001:db8::1; you'll see more of it every year.

To stretch IPv4, home and office networks use private addresses that can't be reached directly from the internet. Three ranges are reserved for this (defined in RFC 1918):

Private range	Shorthand	Where you'll see it
10.0.0.0 – 10.255.255.255	10.0.0.0/8	Larger companies
172.16.0.0 – 172.31.255.255	172.16.0.0/12	Companies and some cloud networks
192.168.0.0 – 192.168.255.255	192.168.0.0/16	Most home routers

Your router has one public IP address assigned by your internet provider. Through NAT (network address translation), it lets all your private devices share that public address. A side effect is useful for security: devices outside can't start a connection to your private devices unless you deliberately open a path (called port forwarding). Remember that phrase; it's where the Boise law office got into trouble.

Two more terms: a MAC address is the hardware ID of a network card, used only on the local network, and DHCP is the service (usually on your router) that hands out IP addresses to devices automatically when they join.

1. Which of these addresses belongs to one of the private (RFC 1918) ranges used inside home and office networks?

172.32.0.5
11.0.0.5
192.168.1.20

192.168.1.20 is inside 192.168.0.0/16. The 172 private range only goes from 172.16 to 172.31, so 172.32.0.5 is not private, and 11.0.0.5 is a public address.

Subnets: what "/24" means

The number after the slash (the prefix) says how many bits identify the network; the rest identify devices. A /24 network like 192.168.10.0/24 has 32 − 24 = 8 bits for devices, so 2⁸ = 256 addresses. Two are reserved (the network address and the broadcast address), leaving 254 usable ones:

Usable addresses = 2^(32 − prefix) − 2
/24 → 2^8 − 2 = 254     /26 → 2^6 − 2 = 62     /28 → 2^4 − 2 = 14

Usable device addresses by prefix (bar length relative to a /24)

/24254

/25126

/2662

/2730

/2814

Why does this matter for security? Subnets are how networks are segmented: staff computers on one subnet, servers on another, guest Wi-Fi on a third, with firewall rules deciding what can talk to what.

Ports and protocols

If an IP address is a building's street address, a port is the apartment number: it tells the computer which program should receive the data. Ports are numbered from 0 to 65,535. Standard services use well-known ports, and security teams memorize the common ones:

Port	Protocol	Used for	Security note
22	SSH	Encrypted remote administration	Never open to the internet with just a password; restrict and use keys or MFA
25 / 587	SMTP	Sending email	Only mail servers need 25; users submit mail on 587 with authentication
53	DNS	Name lookups	Monitor it: malware often uses DNS to find its servers
80	HTTP	Unencrypted web	Redirect to HTTPS
123	NTP	Time synchronization	Accurate time makes logs trustworthy (lesson 13)
443	HTTPS	Encrypted web	The normal port for websites and many apps
445	SMB	Windows file sharing	Never expose to the internet; worms have spread through it
993	IMAPS	Reading email securely	Prefer modern authentication with MFA
3389	RDP	Windows Remote Desktop	Never expose directly; CISA advises against exposing remote services like RDP to the web

2. A log shows a successful connection from your laptop to a bank's server on port 443. What protocol was most likely used?

HTTPS
RDP
SMB

Port 443 is the standard port for HTTPS, the encrypted version of web traffic. RDP uses 3389 and SMB uses 445.

DNS: the internet's phone book

Computers connect to IP addresses, but people type names like example.com. The Domain Name System (DNS) translates one into the other. Here's what happens the first time you visit a site:

Your deviceChecks its cacheIf it looked up the name recently, it reuses the answer.
ResolverAsks a DNS resolverUsually your internet provider's or one you chose in the router settings.
Root and TLD serversFinds who's in charge of ".com"The resolver is pointed to the servers for the top-level domain.
Authoritative serverGets the final answerThe domain's own DNS server returns its IP address.
Back to youConnects and cachesYour browser connects to that IP, and the answer is remembered for a set time.

DNS matters for security in several ways:

Protective DNS: some resolvers refuse to resolve domains known to host malware or phishing, blocking threats before a connection even starts. Many businesses and some home users choose one in their router settings.
Look-alike domains: criminals register names one letter off (typosquatting) to catch mistyped addresses and power phishing.
Email authentication lives in DNS: SPF, DKIM and DMARC records tell receiving servers which systems may send email for your domain, which makes spoofing your company's address much harder.
Hijacked accounts: if someone takes over your domain registrar account, they can redirect your website and email. Protect it with MFA and a registrar lock.

Firewalls and segmentation

A firewall decides which traffic is allowed based on rules: source, destination, port and direction. Modern firewalls are stateful: they remember connections you started, so replies come back in, but unsolicited inbound traffic is blocked. You'll find firewalls in two places:

Network firewall

Sits at the edge (often built into the router) and filters traffic between the office and the internet, and between internal segments.

Golden rule: deny all inbound by default, then allow only what's needed.

Host firewall

Runs on each computer (Windows Defender Firewall, macOS firewall) and protects it even on untrusted networks.

Keep it on: it limits what other devices on the same network can reach.

Segmentation

Splitting the network into zones (staff, servers, guests, printers and cameras) with rules between them.

Why: if one zone is compromised, the damage stays contained.

Case: the Boise law office that closed its back door

A fictional eight-person law office in Boise, Idaho, asked its new IT provider for a quick review. The router's port-forwarding page showed that, years earlier, someone had opened Remote Desktop (port 3389) from the internet straight to the file server so a partner could work from home. Criminals constantly scan for exactly that. The fix took one afternoon. This is the inbound rule table, before and after:

Inbound rule	Before	After	Reason
RDP (3389) from internet to file server	Allowed	Removed	Directly exposed remote service, a common ransomware entry point
Camera viewer (port 8080) from internet	Allowed	Removed	The camera app's cloud service works without an open port
VPN from internet to firewall	Not used	Allowed, MFA required	The one controlled way in for remote work
Everything else inbound	Denied	Denied	Default deny
Guest Wi-Fi to internal subnets	Allowed	Denied	Visitors only need the internet

Now the partner connects to the VPN with MFA first, then uses Remote Desktop inside the protected network. Two exposed services became zero, and the only door left open requires a second factor.

3. You're configuring a new firewall for a small office. What should the default policy be for traffic coming in from the internet?

Allow all, then block known bad addresses
Deny all, then allow only specific services that are truly needed
Allow all traffic on ports below 1024

"Default deny" means anything not explicitly allowed is blocked. Blocklists can never keep up with every bad address, while an allow list stays short and reviewable.

Common mistakes

Opening a port "temporarily" and forgetting about it.

Review port forwarding and firewall rules every quarter, and document why each one exists.

Exposing Remote Desktop or file sharing to the internet.

Use a VPN with MFA or a zero trust access service instead.

Putting servers, staff, guests and cameras on one flat network.

Segment into zones and allow only the traffic each zone needs.

Turning off the host firewall because "the router has one."

Keep both: the host firewall protects laptops on any network.

4. A Nashville clinic wants a separate subnet for its 50 medical devices. How many usable addresses does a /26 provide, and is it enough?

30, so it's not enough
254, far more than needed
62, so it's enough with room to grow

2^(32 − 26) − 2 = 64 − 2 = 62 usable addresses. A /27 gives only 30, while a /24 gives 254.

Practice exercise

An accounting firm's firewall has these inbound rules from the internet: (1) TCP 443 to the client portal web server; (2) TCP 3389 to the receptionist's PC; (3) TCP 445 to the file server; (4) VPN (with MFA) to the firewall; (5) TCP 22 to the web server from any address; (6) a final rule allowing everything else. Identify the risky rules and propose a fix for each.

See solution

Rule 1 is fine: a public web portal needs HTTPS. Keep the server patched and behind a web application firewall if possible.
Rule 2 is risky: Remote Desktop exposed to the internet. Remove it; staff connect through the VPN first.
Rule 3 is very risky: file sharing (SMB) should never be reachable from the internet. Remove it.
Rule 4 is fine: the controlled way in, protected by MFA. Keep the VPN device patched promptly, since edge devices are a top target.
Rule 5 is risky: SSH from any address. Restrict it to the IT provider's fixed address or reach it only through the VPN, with key-based login.
Rule 6 is the worst: it allows everything. Replace it with "deny all," so only rules 1 and 4 remain open.

Summary

Data travels in packets with source and destination addresses; TCP is reliable, UDP is fast.
Private ranges (10/8, 172.16/12, 192.168/16) live behind NAT; port forwarding deliberately punches holes through it.
Ports identify services: know 22, 53, 80, 443, 445 and 3389, and never expose RDP or SMB to the internet.
DNS turns names into addresses and supports protective filtering and email authentication (SPF, DKIM, DMARC).
Firewalls should deny inbound traffic by default, and segmentation keeps one compromised zone from reaching the rest.

Next lesson: Device Security: Updates, Encryption and Backups. You'll protect laptops and phones with updates and encryption and build a 3-2-1 backup plan you can actually restore from.