Network Security Basics: HTTPS, Firewalls, VPNs, Ports and Safe Wi-Fi

Every time you open a website, your request hops across your Wi-Fi router, your internet provider and several networks before it reaches a server — and the reply makes the same journey back. Network security is about making sure nobody along that path can read, change or block what is being sent, and that only the right traffic reaches your systems.

Ports and services in two minutes

An IP address identifies a machine; a port identifies a service on it — like a building address and a flat number. Common ones you should recognise:

Every open port is a door. The fewer doors facing the internet, the smaller your attack surface.

HTTPS and TLS: what the padlock really means

HTTPS is HTTP protected by TLS. It gives three guarantees:

1. Encryption — people on the same Wi-Fi or at your ISP cannot read the traffic.
2. Integrity — the data cannot be changed in transit without detection.
3. Authentication — a certificate, issued by a trusted certificate authority, proves you are talking to the real domain.

For developers: certificates are free (Let's Encrypt) and automatic on most cloud platforms. Serve everything over HTTPS, redirect HTTP, and add the Strict-Transport-Security (HSTS) header so browsers refuse to downgrade.

Firewalls

A firewall allows or blocks traffic based on rules — source, destination, port and protocol.

• Network firewalls and cloud security groups — "allow 443 from anywhere to the load balancer; allow 5432 only from the app servers".
• Host firewalls — on each machine (Windows Defender Firewall, ufw on Linux).
• Web Application Firewalls (WAF) — inspect HTTP requests for attacks like SQL injection; a useful extra layer, never a replacement for secure code.

Good rule sets start from default deny: block everything, then allow only what is needed.

# A minimal Linux server with ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow from 203.0.113.10 to any port 22 proto tcp   # SSH only from your office/home IP
sudo ufw allow 443/tcp                                       # HTTPS for everyone
sudo ufw enable
sudo ufw status verbose

VPNs: what they do and do not do

A VPN creates an encrypted tunnel between your device and a VPN server.

• Corporate VPNs connect employees securely to internal company systems. Increasingly replaced or complemented by Zero Trust access, where every request is verified based on identity and device health, not on being "inside the network".
• Consumer VPNs hide your traffic from the local network and your ISP — but the VPN provider can see it instead. A VPN does not stop phishing, malware or tracking by the websites you log in to.

Common network attacks

• Man-in-the-middle (MITM) — an attacker positions themselves between you and the server, for example via a fake Wi-Fi hotspot. HTTPS with valid certificates defeats most of these.
• DDoS (Distributed Denial of Service) — floods a service with traffic from thousands of compromised devices to take it offline. Defended with CDNs and DDoS-protection services that absorb the flood.
• DNS spoofing — sending users to a fake address for a real domain.
• Port scanning — automated tools constantly scan the internet for open ports and outdated services. Assume anything exposed will be found within hours.

Safe habits on public Wi-Fi (cafés, stations, hostels)

• Check the exact network name with staff — attackers create look-alike hotspots ("Airport_Free_WiFi").
• Stick to HTTPS sites and official apps; avoid banking on open networks if you can use mobile data.
• Turn off automatic connection to open networks and file sharing on your laptop.
• Keep your device updated — most real compromises use known, already-fixed flaws.