32. Linux and Network Hardening

32.6 Network Hardening: Segmentation, VPN and IDS/IPS

By Ravindra Bagale · Last updated: 27 September 2026

Segmentation. Do not put everything on one flat network. Separate web, application, database and admin networks (in AWS: public and private subnets, Chapter 12). If the web server is hacked, the attacker should not reach the database or office PCs directly. Keep guest Wi-Fi separate from the office network.

VPN. Admin access (SSH, database tools) should come over a VPN, not the open internet. WireGuard is a simple modern option; OpenVPN and AWS Client VPN are also common. Then the security group allows port 22 only from the VPN range.

IDS and IPS. An IDS (Intrusion Detection System) watches traffic and alerts; an IPS (Intrusion Prevention System) sits inline and can block. The two best-known open-source engines are Snort and Suricata. Both use rules like this:

alert tcp any any -> $HOME_NET 22 (msg:"Possible SSH brute force"; flags:S; threshold:type both, track by_src, count 10, seconds 60; sid:1000001; rev:1;)
alert http any any -> $HOME_NET any (msg:"SQLi attempt - UNION SELECT"; content:"union"; nocase; content:"select"; nocase; sid:1000002; rev:1;)

Suricata quick lab (on a Linux sensor VM in the host-only network):

sudo yum install -y suricata               # from EPEL on RHEL-family systems
sudo suricata-update                       # download the free Emerging Threats ruleset
sudo nano /etc/suricata/suricata.yaml      # set HOME_NET to "[192.168.56.0/24]" and the right interface
sudo systemctl enable suricata
sudo service suricata start
sudo tail -f /var/log/suricata/fast.log    # alerts appear here

Now scan from Kali with nmap -sS 192.168.56.20 and run a sqlmap test against DVWA (Chapter 21) – alerts appear in fast.log. Suricata's eve.json output can be sent to Wazuh or ELK (Chapter 31).