Audit IoT VLAN Internet Scope

Scenario

The building's IoT VLAN (smart thermostats, badge readers, and similar devices) was set up under a strict policy: these devices may reach only the manufacturer's firmware update service on the Internet, nothing else outbound, and nothing from the Internet may initiate connections to them at all. It's been running for a while with no complaints, which is exactly why nobody has double-checked that the implementation actually matches the policy. You've been asked to verify it does, ahead of a security review.

Learning objectives

• acl
• nftables
• least privilege

Topology and configuration

This environment contains 4 devices (3 Hosts, 1 Router). You configure and troubleshoot the networking skills listed above.

Curriculum topics

• Network Security and Access Control / Least Privilege in Practice

Environment

Subnetica labs run FRRouting and Linux networking with Cisco-like syntax, not Cisco IOS. Commands and behavior may differ from Cisco devices.

Addressing is regenerated on every attempt and the environment is graded automatically.