Hack the Route Start free Open app Labs / Sealed Lines
Road 6 of 11
Sealed Lines
Firewalls, proxies and a bastion at the edge, then encrypted tunnels, signed names and authenticated mail.
Start this road, freeACLs & firewalls
Access lists and firewalls deciding what crosses.
- 01 Access control lists: who may cross the router, and where to say so Write router access lists and see why where you put them matters. Free
- 02 Drop or reject: what a firewall tells a scanner Block a port two ways, drop vs reject, and see what each tells a scanner. Pro
- 03 A stateful firewall: replies come home, nothing new gets in Build a stateful firewall that lets replies home while keeping new connections out. Pro
SSH bastion, proxies & WAF
One guarded way in, and proxies that read the traffic.
- 01 The bastion: one guarded door into a private network Reach a walled-off server through one guarded, logged jump host. Pro
- 02 A forward proxy: the office's one way out to the web Send the office's web through a proxy that reads every URL. Pro
- 03 A reverse proxy and a web application firewall Guard a shop with rules that read each request, not just its packets. Pro
GRE, VPN & IPsec
Tunnels from plain GRE to IPsec.
- 01 GRE tunnels: a private link across a network that will not carry it Join two private sites across a network that will not route them. Pro
- 02 VPN: a private tunnel across a hostile network Reach a closed office over WireGuard, and stop a DNS leak. Pro
- 03 IPsec: two offices, one untrusted network between them Join two offices over IPsec, and see what the ISP still reads. Pro
DNSSEC & email authentication
Signed names and authenticated mail.