2026-09-22 · class-notes, tryhackme, networking, firewalls, vpn, vlans
Full class notes for TryHackMe Pre Security (2026 path) module 5, Extending Your Network: port forwarding, stateful and stateless firewalls, VPNs, routers, switches and VLANs.
Class notes · TryHackMe Pre Security (2026 path) · Module 5, room 5: Extending Your Network
Quick reference: the short version of this room is the Extending Your Network cheat sheet, the fifth sheet in Module 5, after Packets & Frames. The A+ lesson on network devices covers firewalls and switches from the exam's angle, and Networking for Sysadmins chapter 2 goes deeper on VLANs.
By the end of these notes you should be able to:
A service running inside a network is, by default, only reachable from inside that network. A web server on 192.168.1.10 listening on port 80 can be used by the other machines on 192.168.1.x — an intranet — and by nobody else, because its address is private and the internet cannot route to it.
Port forwarding changes that. It is configured on the network's router, and it says: traffic arriving at the public address on a given port should be handed to a particular internal machine and port. Visitors then reach the service through the network's public IP address.
THE INTERNET ROUTER NETWORK 1
Visitor --- to 203.0.113.70:80 ---> +----------+
| Port |
| forward: |--- 192.168.1.10:80
| 80 -> | (web server)
| .1.10:80 |
+----------+--- 192.168.1.11
(PC, not exposed)
Without the forward, only 192.168.1.x could reach the web server.
Note (beyond this lesson): port forwarding is really a NAT rule. The router rewrites the destination address (and often the port) of arriving packets so they land on the internal host, and rewrites the replies on the way back. That is why it is sometimes called destination NAT.
It is easy to confuse the two. Port forwarding exposes a service: it creates a path from the outside world to one internal machine and port. A firewall decides whether traffic is allowed along a path. A port can be forwarded and still be blocked by firewall rules, and on many home routers the two settings live side by side.
The web server at 192.168.1.10:80 should be reachable from the internet at the router's public address 203.0.113.70.
192.168.1.10 port 80.A firewall controls what traffic may enter and leave a network: border control for the network. An administrator writes rules that permit or deny traffic based on questions such as:
| Question | Example rule |
|---|---|
| Where is the traffic from? | Deny anything from this network range |
| Where is it going? | Allow traffic to the web server only |
| Which port is it for? | Allow port 80, deny everything else |
| Which protocol? | Allow TCP, deny UDP |
The firewall inspects packets to answer those questions.
Firewalls come in all sizes: dedicated hardware in large organisations, the firewall built into a home router, and software running on a host, such as Windows Defender Firewall, nftables on Linux or pf on BSD.
Correction: the room gives Snort as an example of a software firewall. Snort is an intrusion detection and prevention system: it inspects traffic and alerts on (or blocks) patterns that look like attacks. That is a related but different job from a firewall's allow-and-deny rules.
A stateful firewall tracks whole connections rather than judging each packet alone. It remembers that a connection was established and treats later packets in the light of that: replies to traffic you allowed out are allowed back in, and packets that don't belong to any known connection can be dropped.
That knowledge costs memory and processing, since the firewall keeps a table of every live connection, but it makes far better decisions than rules alone.
Correction: the room says a stateful firewall blocks the entire device if "a connection from a host is bad". That is not what stateful means. Statefulness is about tracking connection state (new, established, related) and judging packets against it. Blocking a whole host after bad behaviour is a different feature, usually from an intrusion prevention system or a blocklist.
A stateless firewall applies a static set of rules to each packet on its own, with no memory of what came before. It uses far fewer resources, which is why it copes well with huge volumes of traffic, such as absorbing a distributed denial-of-service attack at the edge of a network.
The trade-off is that it is only as good as its rules. It cannot tell a reply from an unsolicited packet, so rules must be written to cover both directions, and anything the rules don't match exactly slips through or is blocked by accident.
| Stateful | Stateless | |
|---|---|---|
| Decides on | The whole connection | One packet at a time |
| Remembers | Every live connection | Nothing |
| Resource use | Higher | Very low |
| Return traffic | Allowed automatically | Needs its own rule |
| Best at | Normal traffic, accurate decisions | Huge volumes, simple filtering |
A company wants staff to browse the web, but nothing from the internet to start a connection inward.
A VPN (virtual private network) lets devices on separate networks communicate securely by creating a dedicated encrypted path between them across the internet, called a tunnel. The devices inside the tunnel form their own private network.
In the room's example, two offices each have their own network, and the VPN forms a third network across them. Machines on it remain part of their own office networks, but also share a private network that only VPN-connected devices can use.
OFFICE 1 (network 1) OFFICE 2 (network 2)
192.168.1.0/24 192.168.2.0/24
| |
+----+----+ +----+----+
| Router |=========== VPN tunnel ============| Router |
+----+----+ encrypted, over the +----+----+
| public internet |
servers staff PCs
Inside the tunnel the two offices behave like one private network;
anyone in between sees only encrypted traffic.
| Benefit | What it means |
|---|---|
| Joining locations | Offices in different places share servers and infrastructure as if they were on one network |
| Privacy | The tunnel is encrypted, so the traffic can't be read in transit. This matters most on public Wi-Fi, where the network provides no encryption of its own |
| Anonymity | Traffic reaches the internet from the VPN provider, not from you, which is why journalists and activists rely on VPNs where speech is restricted |
The anonymity point comes with a condition the room makes well: it only goes as far as the provider's respect for privacy. A VPN that logs everything you do gives you no more anonymity than not using one.
TryHackMe itself uses a VPN to connect you to its deliberately vulnerable machines. That keeps those machines off the public internet, keeps your practice traffic inside the tunnel, and means your ISP doesn't see what looks like you attacking things.
Note (beyond this lesson): a VPN moves the point at which your traffic joins the internet; it does not make you anonymous. Logging in to an account, browser fingerprinting and cookies identify you just as well inside a tunnel as outside it.
| Technology | What it is |
|---|---|
| PPP | Point-to-Point Protocol: carries traffic over a single link and handles authentication. It is not routable on its own, so it cannot leave a network unaided |
| PPTP | Point-to-Point Tunneling Protocol: wraps PPP so it can travel across networks. Easy to set up and widely supported, but weakly protected |
| IPsec | Internet Protocol Security: encrypts and authenticates traffic within the existing IP framework. Harder to configure, but strong and widely supported |
Correction: the room says PPP provides encryption and works "by using a private key and public certificate (similar to SSH)". PPP itself provides framing and authentication (with PAP, CHAP or EAP), not encryption; in a PPTP tunnel the encryption comes from a separate protocol, MPPE. The key-and-certificate description belongs to TLS-based and IPsec-based VPNs, not to PPP.
Caution: PPTP is not merely "weakly encrypted": its authentication and encryption have been broken for years and it is considered obsolete. Treat finding it in use as something to replace, not to configure.
Note (beyond this lesson): the technologies in common use today are IPsec (often with IKEv2), OpenVPN and WireGuard, the last being much simpler and faster than the older options.
A router connects networks and passes data between them, which is routing. It works at layer 3 of the OSI model, and it usually has a management interface, a web page or a console, where an administrator configures things like port forwarding and firewall rules.
Where two networks are joined by more than one path, the router chooses which to use. The factors are the ones from the OSI Model room: which path is shortest, which is most reliable, and which uses the faster medium, such as fibre rather than copper.
A switch connects many devices over Ethernet. A layer 2 switch forwards frames to the right device using MAC addresses, with the IP packets sitting untouched inside those frames. That is its whole job: get each frame to the correct port.
Correction: the room says switches handle "from 3 to 63" devices. Real port counts are 5, 8, 16, 24 or 48 on ordinary switches, and chassis switches in the core of a large network run to hundreds of ports. The earlier Intro to LAN room gives the more usual figures.
A layer 3 switch does the layer 2 job and some of a router's: it forwards frames by MAC address and routes packets by IP address. This is what lets one switch hold several networks, each with its own gateway address on the switch, and move traffic between them at switching speed.
A layer 2 switch cannot work at layer 3: the capability is either in the hardware or it isn't.
A VLAN (virtual local area network) splits the devices on a switch into separate virtual networks. Each VLAN behaves like its own network, even though the devices share the same physical switch, which is why a single switch can serve a Sales department and an Accounting department that both reach the internet but are kept apart from each other.
+-------------------------+
| Layer 3 switch |
Internet --------+ VLAN 10: 192.168.1.1 |
| VLAN 20: 192.168.2.1 |
+----+---------------+----+
| |
VLAN 10 VLAN 20
Sales Accounting
192.168.1.x 192.168.2.x
Both reach the internet. Whether Sales can reach Accounting depends
on the rules on the switch, not on the VLANs alone.
Correction: the room says VLANs mean the two departments "are not able to communicate with each other". Separation is the starting point, but if the switch routes between the VLANs, as a layer 3 switch does, traffic will pass unless rules stop it. The security comes from the VLAN plus the access rules or firewall between them.
Sales and Accounting share one 48-port switch, and Accounting's systems must not be reachable from Sales.
192.168.1.0/24 and 192.168.2.0/24.| Term | Meaning |
|---|---|
| Firewall | A device or software that permits or denies traffic by rule |
| Intranet | A network's internal services, reachable only from inside |
| IPsec | A VPN technology that encrypts and authenticates IP traffic |
| Layer 2 switch | A switch that forwards frames using MAC addresses |
| Layer 3 switch | A switch that also routes packets using IP addresses |
| MPPE | The protocol that encrypts data inside a PPTP tunnel |
| Packet inspection | Examining a packet's headers (and sometimes contents) to decide what to do with it |
| Port forwarding | A router rule sending traffic from a public port to an internal host and port |
| PPP | Point-to-Point Protocol: framing and authentication over a single link |
| PPTP | Point-to-Point Tunneling Protocol: an old, insecure VPN protocol |
| Router | A device that connects networks and forwards between them at layer 3 |
| Stateful firewall | One that tracks connections and judges packets in that context |
| Stateless firewall | One that judges each packet against static rules alone |
| Tunnel | An encrypted path across a public network carrying private traffic |
| VLAN | A virtual LAN: a separate network sharing physical switch hardware |
| VPN | Virtual private network: devices on separate networks joined by a tunnel |
192.168.1.10 by default?