Finance Subnet Default Deny

Scenario

A new finance reporting subnet is being stood up to host a small number of sensitive applications. Rather than following the network's usual pattern of "open by default, restrict specific paths as problems come up," leadership wants this one built the opposite way from the start: nothing reaches it except two explicitly documented, legitimate paths, and everything else — including combinations nobody has specifically thought to test yet — should be denied by default.

Learning objectives

• acl
• nftables
• least privilege

Topology and configuration

This environment contains 6 devices (5 Hosts, 1 Router). You configure and troubleshoot the networking skills listed above.

Curriculum topics

• Network Security and Access Control / Filtering by Address

Environment

Subnetica labs run FRRouting and Linux networking with Cisco-like syntax, not Cisco IOS. Commands and behavior may differ from Cisco devices.

Addressing is regenerated on every attempt and the environment is graded automatically.