Course overview
The Foundations of Network Security course starts from the packet and works outward. You will capture and analyse real traffic, understand how common protocols behave, and then look at the controls that defend a network — firewalls, segmentation, VPNs and monitoring. The course assumes you already know the basics of TCP/IP and are comfortable in a command line; it does not assume you have configured a firewall before.
Who this course is for
This course is designed for the following groups. If you are not sure whether you fit, ask us — a short conversation is more useful than a longer guess.
- System and network administrators responsible for security
- IT staff who need to understand what is happening on their network
- Security analysts moving into network-focused roles
- Students who have completed a networking fundamentals course
- Anyone preparing for a role that involves firewalls or VPNs
What you will learn
- How TCP/IP actually behaves on a real network, packet by packet
- Capturing and analysing traffic with Wireshark and tcpdump
- The security implications of DNS, DHCP, ARP and common protocols
- Designing and applying firewall rules that hold up under pressure
- Network segmentation as a control, not just a diagram
- VPN fundamentals and the trade-offs between the common options
- Monitoring a network for the behaviour that precedes an incident
- Reading packet captures to answer specific security questions
Curriculum
The course is taught in the module order below. Each module mixes explanation with hands-on work before moving on to the next.
- Networking Fundamentals
- Firewalls & Access Control
- IP Addressing & Subnetting
- Secure Network Design
- VPNs & Remote Access
- Network Protocols Security
- Network Devices & Infrastructure
- Network Monitoring & Incident Response
- Packet Analysis & Traffic Monitoring
- Network Threats & Attacks
- Capstone Project
Tools and technologies
Everything used in the course is either free, open source, or available on a free tier suitable for learning. You will install and configure each of these during the course, not just watch someone else use them.
- Wireshark
- tcpdump
- Nmap
- Linux networking tools (ip, ss, iptables/nftables)
- pfSense or an equivalent firewall platform
- OpenVPN or WireGuard for VPN labs
- A virtualised network topology for lab work
Prerequisites
We would rather you arrive prepared than arrive surprised. These are the things you should already be comfortable with before the first session.
- Comfort with the Linux command line
- Basic understanding of TCP/IP, IP addresses and subnetting
- Familiarity with the OSI model at a conceptual level
- A machine capable of running a small virtual network
Hands-on labs, CTFs and projects
Most of the course is spent on machines. The work below is what turns each topic from something you have read about into something you can actually do.
- Build a small multi-segment network in virtual machines
- Capture and analyse a full TCP handshake and a DNS resolution
- Write and test a firewall ruleset against a scripted attack scenario
- Configure a site-to-site VPN between two lab networks
- Investigate a captured incident and produce a short findings summary
Learning outcomes
When you finish this course, these are the things you should be able to do without looking them up. Anything you cannot yet do, the trainer will help you with during the final project review.
- Read a packet capture and explain what is happening
- Configure a firewall to enforce a stated security policy
- Segment a network to limit the spread of a compromise
- Set up and reason about a VPN
- Recognise the network behaviour that precedes common attacks
- Discuss network risk with both technical and non-technical colleagues
Career paths
This course supports the roles below. We do not make placement claims or guarantee outcomes — what you do with the skills is up to you — but these are the job titles that most often ask for what this course teaches.
- Network security engineer
- Security analyst with a network focus
- Firewall and perimeter engineer
- Network administrator with security responsibilities
- Infrastructure security consultant
Frequently asked questions
You should already understand IP addressing, subnetting and the basic TCP/IP model. You do not need to have configured enterprise network equipment, but you should be comfortable reasoning about what an IP address and a subnet mask actually mean.
The labs use Linux firewalls (iptables/nftables) and pfSense, because between them they cover the concepts that transfer to any vendor platform. The skills you build — reading a rule, reasoning about state, understanding default deny — apply equally to commercial appliances.
Yes, provided your current role has not already required you to think about security. The course is designed to move an experienced network professional into security-focused work by giving them the packet-level and control-level understanding that security roles demand.
No. Everything in the course runs in virtual machines on your own computer. A machine with at least 8 GB of RAM and 40 GB of free disk space is recommended so you can run the full lab topology without slowness.
