LFCE 5 🐧 Network Architecture — LAN, WAN, DMZ

The LFCE exam is retired, but its curriculum remains the benchmark for advanced Linux engineering. The Networking domain (15%) required understanding how to connect and secure systems across different trust boundaries. Network architecture is the foundation for those tasks: a LAN is the trusted internal network, a WAN connects geographically separated sites, and a DMZ is a buffer zone that exposes public services without compromising the internal network.

Key point: The LFCE tested the ability to configure a Linux system as a router and firewall, which requires understanding the flow of traffic between the LAN, the WAN, and the DMZ. The DMZ is not a physical location; it is a logical network segment defined by firewall rules that isolate public-facing services from the internal LAN.

---

Why network architecture matters for Linux engineering

The trust boundary problem. The LAN contains the internal systems: workstations, databases, and internal application servers. These systems trust each other and often run services that should never be exposed to the internet. The WAN is the untrusted network—the internet or a public transit link. The DMZ sits between them. It hosts the services that must be reachable from the WAN, such as a web server or a reverse proxy, but it is isolated from the LAN by the firewall. If the web server in the DMZ is compromised, the attacker cannot pivot directly into the LAN.

The routing problem. A Linux system acting as the gateway between these networks must perform Network Address Translation (NAT) for the LAN to reach the internet, and it must route traffic between the DMZ and the WAN without exposing the LAN. The LFCE Networking objectives included “Configure a system to perform Network Address Translation” and “Dynamically route IP traffic,” which are the mechanisms that make the LAN-WAN-DMZ topology work.

The firewall problem. The firewall rules define the architecture. A default-deny policy on the forwarding chain, with explicit allow rules for the DMZ services and the LAN-to-WAN traffic, is the standard implementation. The LFCE tested “advanced packet filtering,” which in this context means writing the rules that enforce the separation between the three zones.

The DMZ service problem. The services in the DMZ are deliberately exposed. A reverse proxy in the DMZ can terminate TLS and forward requests to the internal application servers in the LAN, which means the internal servers never accept direct connections from the WAN. This is the “host-based and user-based security for a service” objective from the LFCE Service Configuration domain.

The trade-off. A flat network with no DMZ is simpler to configure but exposes every internal system to the WAN. A three-zone architecture requires more firewall rules and more careful routing, but it limits the blast radius of a compromise. The LFCE expected the engineer to design the three-zone architecture and implement it with Linux tools.

---

a. The LAN, WAN, and DMZ topology

The standard three-zone topology uses a Linux gateway with at least two network interfaces: one connected to the WAN, one to the LAN, and optionally a third for the DMZ. The DMZ is often a separate VLAN or a separate physical interface on the gateway.

# The gateway interfaces
# eth0: WAN (public IP, e.g., 203.0.113.10/24)
# eth1: LAN (private IP, e.g., 192.168.1.1/24)
# eth2: DMZ (private IP, e.g., 192.168.2.1/24)

# Enable IP forwarding (runtime)
sudo sysctl -w net.ipv4.ip_forward=1

# Make it persistent
echo "net.ipv4.ip_forward = 1" | sudo tee /etc/sysctl.d/99-forwarding.conf
sudo sysctl --system

The net.ipv4.ip_forward=1 enables the kernel to forward packets between interfaces. Without it, the gateway drops all traffic that is not destined for itself. The persistent drop-in file ensures the setting survives a reboot.

The LAN hosts use the gateway as their default route. The DMZ hosts use the DMZ interface address as their gateway. The WAN hosts reach the DMZ services through the public IP and the NAT rules on the gateway.

---

b. Network Address Translation (NAT)

NAT is the mechanism that allows the LAN hosts to reach the WAN while hiding their private addresses. The gateway rewrites the source address of outbound packets to its public IP and tracks the connections to route the replies back.

# The nftables NAT rule (modern)
sudo nft add table ip nat
sudo nft add chain ip nat postrouting { type nat hook postrouting priority 100 \; }
sudo nft add rule ip nat postrouting ip saddr 192.168.1.0/24 oifname "eth0" masquerade

# The iptables alternative
sudo iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE

The masquerade target rewrites the source address to the outgoing interface’s address. The -s 192.168.1.0/24 limits the rule to the LAN subnet. The DMZ does not use NAT for inbound traffic; the public services are exposed through DNAT (destination NAT) or a reverse proxy.

The DNAT rule for a DMZ web server.

# Forward WAN port 80 to the DMZ web server
sudo nft add rule ip nat prerouting iifname "eth0" tcp dport 80 dnat to 192.168.2.10:80

# The iptables alternative
sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 192.168.2.10:80

The prerouting chain processes the packet before the routing decision. The dnat target rewrites the destination address to the DMZ server. The reply from the DMZ server is rewritten back to the WAN client by the connection tracking.

---

c. The firewall rules that enforce the zones

The firewall rules are the enforcement mechanism. The default policy should be drop for the forwarding chain, with explicit allow rules for the required traffic.

# The nftables ruleset (simplified)
sudo nft add table ip filter
sudo nft add chain ip filter forward { type filter hook forward priority 0 \; policy drop \; }

# Allow established connections (the replies)
sudo nft add rule ip filter forward ct state established,related accept

# Allow the LAN to the WAN
sudo nft add rule ip filter forward iifname "eth1" oifname "eth0" accept

# Allow the WAN to the DMZ web server (port 80)
sudo nft add rule ip filter forward iifname "eth0" oifname "eth2" ip daddr 192.168.2.10 tcp dport 80 accept

# Allow the DMZ to the LAN database (specific service)
sudo nft add rule ip filter forward iifname "eth2" oifname "eth1" ip daddr 192.168.1.50 tcp dport 3306 accept

The ct state established,related rule allows the reply traffic from the outbound connections. The iifname and oifname match the input and output interfaces, which is the zone identifier. The DMZ-to-LAN rule is deliberately narrow: only the specific database host and port are allowed.

The policy drop on the forward chain is the default-deny. A packet that does not match any allow rule is dropped. This is the architecture in code: the LAN, WAN, and DMZ are separated by the rules, not by the physical topology.

---

Complete Example Session

# ============================================
# PART 1: ENABLE IP FORWARDING
# ============================================

sudo sysctl -w net.ipv4.ip_forward=1
echo "net.ipv4.ip_forward = 1" | sudo tee /etc/sysctl.d/99-forwarding.conf
sudo sysctl --system

# ============================================
# PART 2: THE NAT FOR THE LAN
# ============================================

sudo nft add table ip nat
sudo nft add chain ip nat postrouting { type nat hook postrouting priority 100 \; }
sudo nft add rule ip nat postrouting ip saddr 192.168.1.0/24 oifname "eth0" masquerade

# ============================================
# PART 3: THE DNAT FOR THE DMZ WEB SERVER
# ============================================

sudo nft add chain ip nat prerouting { type nat hook prerouting priority -100 \; }
sudo nft add rule ip nat prerouting iifname "eth0" tcp dport 80 dnat to 192.168.2.10:80

# ============================================
# PART 4: THE FORWARD CHAIN
# ============================================

sudo nft add table ip filter
sudo nft add chain ip filter forward { type filter hook forward priority 0 \; policy drop \; }
sudo nft add rule ip filter forward ct state established,related accept

# ============================================
# PART 5: THE LAN TO WAN
# ============================================

sudo nft add rule ip filter forward iifname "eth1" oifname "eth0" accept

# ============================================
# PART 6: THE WAN TO DMZ
# ============================================

sudo nft add rule ip filter forward iifname "eth0" oifname "eth2" ip daddr 192.168.2.10 tcp dport 80 accept

# ============================================
# PART 7: THE DMZ TO LAN (NARROW)
# ============================================

sudo nft add rule ip filter forward iifname "eth2" oifname "eth1" ip daddr 192.168.1.50 tcp dport 3306 accept

# ============================================
# PART 8: VERIFY
# ============================================

sudo nft list ruleset

# ============================================
# PART 9: TEST
# ============================================

# From the LAN: curl http://203.0.113.10 (the WAN IP) → the DMZ web server
# From the DMZ: ssh to the LAN database → allowed on port 3306 only

The nine parts trace the three-zone architecture: the forwarding, the LAN NAT, the DMZ DNAT, the default-deny forward chain, the LAN-to-WAN allow, the WAN-to-DMZ allow, the narrow DMZ-to-LAN allow, the verification, and the test.

---

Quick Reference

The Zones

Zone	Trust Level	Typical Services
LAN	High	Databases, internal apps
DMZ	Medium	Web servers, proxies
WAN	Low	The internet

The Gateway Interfaces

Interface	Zone	Address
eth0	WAN	Public IP
eth1	LAN	Private IP (e.g., 192.168.1.1)
eth2	DMZ	Private IP (e.g., 192.168.2.1)

The NAT Types

Type	Chain	Purpose
SNAT/Masquerade	postrouting	LAN to WAN
DNAT	prerouting	WAN to DMZ

The Firewall Policies

Chain	Policy	Purpose
forward	drop	Default-deny
input	drop	Protect the gateway
output	accept	Gateway outbound

---

Best Practices

✅ Do This:

sudo nft add chain ip filter forward { type filter hook forward priority 0 \; policy drop \; }
<!-- Default-deny on the forward chain -->           # ✅

sudo nft add rule ip filter forward iifname "eth0" oifname "eth2" ip daddr 192.168.2.10 tcp dport 80 accept
<!-- Explicit allow for the DMZ web server -->        # ✅

sudo nft add rule ip filter forward iifname "eth2" oifname "eth1" ip daddr 192.168.1.50 tcp dport 3306 accept
<!-- Narrow DMZ-to-LAN access -->                     # ✅

❌ Don’t Do This:

# Allow all forwarding
<!-- The DMZ can reach the LAN freely -->            # ❌

# Expose the LAN database directly to the WAN
<!-- The DMZ is bypassed -->                         # ❌

# Forget the established,related rule
<!-- The replies from the outbound connections drop --> # ❌

---

Common Pitfalls

Pitfall	Why It Happens	Fix
LAN cannot reach the WAN	No masquerade rule	Add the postrouting SNAT
WAN cannot reach the DMZ	No DNAT or forward allow	Add the prerouting DNAT and the forward rule
The DMZ can reach everything	No default-deny or broad allow	Set policy drop and narrow rules
The replies drop	No established,related rule	Add the stateful rule
The gateway is exposed	No input policy	Set policy drop on input

---

Real-World Examples

1. Enable Forwarding

sysctl -w net.ipv4.ip_forward=1

2. LAN Masquerade

nft add rule ip nat postrouting ip saddr 192.168.1.0/24 oifname "eth0" masquerade

3. DMZ DNAT

nft add rule ip nat prerouting iifname "eth0" tcp dport 80 dnat to 192.168.2.10:80

4. Default-Deny Forward

nft add chain ip filter forward { type filter hook forward priority 0 \; policy drop \; }

5. LAN to WAN

nft add rule ip filter forward iifname "eth1" oifname "eth0" accept

6. WAN to DMZ

nft add rule ip filter forward iifname "eth0" oifname "eth2" ip daddr 192.168.2.10 tcp dport 80 accept

7. DMZ to LAN

nft add rule ip filter forward iifname "eth2" oifname "eth1" ip daddr 192.168.1.50 tcp dport 3306 accept

8. Stateful

nft add rule ip filter forward ct state established,related accept

9. Verify

nft list ruleset

10. Test

curl http://203.0.113.10

---

Visual

The Three-Zone Topology

┌──────────────────────────────────────────────┐
│  WAN (the internet)                          │
└──────────────────┬───────────────────────────┘
                   │ eth0
                   ▼
┌──────────────────────────────────────────────┐
│  Linux Gateway                               │
│  ├── IP forwarding enabled                   │
│  ├── NAT (masquerade, DNAT)                  │
│  └── Firewall (default-deny forward)         │
└──────────┬───────────────────────┬───────────┘
           │ eth1                  │ eth2
           ▼                       ▼
┌──────────────────────┐  ┌──────────────────────┐
│  LAN (trusted)       │  │  DMZ (public)        │
│  ├── Database        │  │  ├── Web server      │
│  └── Internal apps   │  │  └── Reverse proxy   │
└──────────────────────┘  └──────────────────────┘

The Firewall Enforcement

┌──────────────────────────────────────────────┐
│  Forward chain (policy drop)                 │
│                                              │
│  1. established,related → accept             │
│  2. LAN → WAN → accept                       │
│  3. WAN → DMZ (port 80) → accept             │
│  4. DMZ → LAN (port 3306) → accept           │
│  5. Everything else → drop                   │
└──────────────────────────────────────────────┘

---

Summary

Item	Value
LAN	Trusted internal network
WAN	Untrusted external network
DMZ	Public-facing buffer zone
Gateway	Linux system with multiple interfaces
NAT (LAN)	SNAT/masquerade on postrouting
NAT (DMZ)	DNAT on prerouting
Firewall	Default-deny forward chain
Stateful	ct state established,related accept

Key takeaways:

• The LAN is trusted; the WAN is not; the DMZ is the buffer. The DMZ hosts the services that must be reachable from the WAN without exposing the LAN.
• The Linux gateway is the enforcement point. It forwards the traffic between the zones, performs the NAT for the LAN and the DNAT for the DMZ, and applies the firewall rules.
• The forward chain is default-deny. The policy drop is the architecture. The explicit allow rules define the permitted traffic between the zones.
• The stateful rule is mandatory. The ct state established,related accept allows the replies from the outbound connections. Without it, the LAN cannot browse the WAN.
• The DMZ-to-LAN access is narrow. The DMZ should not have broad access to the LAN. A specific host and port (e.g., the database on 3306) is the limit.

Remember: The network architecture is the trust model. The LAN, the WAN, and the DMZ are the zones. The gateway is the enforcement. The NAT is the address translation. The firewall is the separation. The exam tested the ability to implement this architecture with the Linux tools, and the skills remain the foundation for the advanced Linux engineering.

---

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!