Systems and networks in Year 5: VLANs, NAT and firewalls

Late September 2026, computer science and telecommunications track (Italian Informatica e telecomunicazioni, at technical institutes): in Year 5, Systems and networks (Sistemi e reti) opens the year with the application layer (HTTP, DNS, FTP, email) and moves almost at once to VLANs and inter-VLAN routing, then arrives at cryptography, certificates, SSL/TLS, firewalls, proxies, ACLs, DMZ, NAT, VPN/IPsec, wireless and virtualisation. The first test on this block falls five to eight weeks later, so between the end of October and mid-November. And it is also the year of the maturità (Italy’s school-leaving exam): the complete network design that appears in the second paper of Computer Science is built exactly with the building blocks of this period.

The Year 5 test asks you to design, not to define

The jump from previous years is sharp. In Years 3 and 4 the test asked “what is a nested loop” or “calculate the subnet”: one question, one precise answer. In Year 5 the typical question is different: they give you a brief — a company with three departments, a public server, a remote site — and ask you to design the network. It is not enough to know what a VLAN is: you have to decide how many are needed, how they are addressed, how they communicate with each other, where control is placed, how you go out to the internet, how you get in from outside.

Whoever learns definitions by heart arrives at the test with isolated pieces. Whoever learns a fixed order for tackling any brief copes even when the details change. The checklist I use in lessons, always in the same order:

1. Segmentation — how many VLANs are needed and why (by department, by function, by security level).
2. Addressing — which subnet for each VLAN, with how many expected hosts.
3. Routing between VLANs — how the VLANs communicate with each other (router-on-a-stick or layer 3 switch).
4. Control points — where ACLs and firewalls are needed, and with which rules.
5. Exit to the internet — NAT, and which type.
6. Remote access — VPN, if the brief includes a remote site or an external user.

The rest of this post follows the same order.

VLANs: why a network is segmented

A VLAN (Virtual LAN) is a separate logical broadcast domain, built on top of the same physical infrastructure. Without VLANs, all the devices connected to the same switches share a single broadcast domain: every broadcast (an ARP request, for example) reaches everyone, traffic grows with the number of hosts, and there is no separation between different departments that are on the same cabling.

Segmenting into VLANs solves two problems at once: performance (fewer hosts per broadcast domain, less useless traffic for each) and security (a device in the Administration VLAN doesn’t see the traffic of the Production VLAN, even though they are connected to the same physical switches).

Each port of a switch can be configured in two ways:

• access: it belongs to a single VLAN, and it is the mode used to connect a PC or a printer;
• trunk: it carries the 802.1Q marking, that is a tag that identifies which VLAN each frame belongs to, and it is the mode used to connect different switches to each other or a switch to a router, to carry the traffic of several VLANs over the same cable.

Inter-VLAN routing: how VLANs talk to each other

VLANs, by definition, don’t see each other at layer 2: a device in VLAN 10 can’t directly reach a device in VLAN 20 without going through a layer 3 device that does routing. Two ways of doing it, both to be known:

• router-on-a-stick: a single router, connected to the switch with a single trunk port, configured with several sub-interfaces (one per VLAN, each with its own IP address and its own 802.1Q tag). All the inter-VLAN traffic passes over that single physical link.
• layer 3 switch (multilayer switch): the switch itself does routing between VLANs through virtual interfaces (SVIs), one per VLAN. Faster and more scalable than router-on-a-stick, because there is no single link acting as a bottleneck, but it requires hardware that supports layer 3.

NAT: why it is needed and what it doesn’t do

NAT (Network Address Translation) translates private IP addresses into a public address (or a pool of public addresses) when traffic goes out to the internet. Three variants:

• static NAT: a fixed correspondence, one private address ↔ one public address. Typically used for a server that must be reachable from outside at a stable public address.
• dynamic NAT: a pool of public addresses assigned dynamically to private hosts that request one, one by one, until the pool runs out.
• PAT (Port Address Translation), also called NAT overload: a single public address shared by the whole private network, telling the connections apart by the source port. It is the most common form in real networks, because it doesn’t need a pool of public addresses proportional to the number of hosts.

NAT is not a security measure: it was born to save public IPv4 addresses, not to protect the network. The fact that it hides the internal structure of the network is a useful side effect, not its purpose, and it doesn’t replace firewalls and ACLs.

ACLs and firewalls: where control is placed

An ACL (Access Control List) is an ordered list of rules that allow or deny traffic based on criteria such as source address, destination, protocol, port. Two types:

• standard ACL: filters only on the source IP address. Simple, but not very selective.
• extended ACL: filters on source, destination, protocol and port together. It is the one used for precise control (for example: “allow only HTTPS traffic to that server”).

Two rules never to forget, because they are the most frequent mistake in tests:

• rules are evaluated in the order in which they are written, top to bottom, and the first one that matches is applied: a generic rule written before a specific one cancels the specific one, because the traffic never gets to be evaluated against it;
• at the end of every Cisco ACL there is an implicit deny any, even if you don’t write it: if no rule matches, the traffic is discarded. Forgetting it leads you to believe that an “unregulated” packet gets through, when in fact it is blocked.

The firewall does a similar job to ACLs but with more context:

• stateless: evaluates each packet in isolation, like an ACL.
• stateful: keeps track of connections already established and automatically lets through the reply traffic to a connection started from inside, without needing an explicit rule for the return direction.

The DMZ (demilitarised zone) is a separate subnet, isolated from both the internal network and the internet by firewall rules, where you put the servers that must be reachable from outside (a public web server, a mail server). If that server is compromised, whoever attacks it finds themselves in the DMZ, not in the internal network: the DMZ is the reason a public server must never be put inside the LAN. The proxy, finally, mediates requests between internal clients and the internet (forward proxy) or between the internet and an internal server (reverse proxy), adding a layer of control and, often, caching.

VPN: secure remote access

A VPN (Virtual Private Network) creates an encrypted channel over an untrusted network like the internet. Two scenarios:

• site-to-site: connects two networks (for example the head office and a branch) permanently, as if they were on the same LAN.
• client-to-site (or remote access): connects a single remote user to the company network, typically from a software client on their device.

IPsec, in two lines: it is the most widely used protocol for building VPNs at the network layer, and it encrypts and authenticates IP traffic between two endpoints.

Typical mistakes to avoid

• Writing a permit any rule before the specific rules: it cancels the whole ACL, because the first match wins.
• Forgetting the implicit deny any at the end of every ACL: if you don’t allow for it explicitly in your reasoning, you risk taking for granted that traffic gets through which is in fact discarded.
• Confusing VLAN and subnet: they are concepts at different layers (2 and 3), but in practice they always go in pairs — a VLAN without a subnet of its own isn’t much use, and vice versa.
• Thinking that NAT protects the network: NAT translates addresses, it doesn’t filter traffic. Security is the job of ACLs and firewalls.
• Putting a public server inside the LAN instead of in the DMZ: if the server is compromised, the attacker has direct access to the whole internal network.

Three worked exercises

Exercise 1 — segmentation of a company with three departments and a public server.

Brief: a company has the departments Administration (20 hosts), Production (50 hosts) and IT (10 hosts), plus a web server that must be reachable from the internet.

Segmentation:

Each VLAN has a subnet sized above the expected number of hosts, not exact: you always choose the mask immediately above the need, to leave a margin. The public server has no VLAN among the internal ones: it sits in the DMZ, precisely so as not to expose the rest of the network if it is compromised.

Exercise 2 — extended ACL in Cisco pseudocode.

Brief: allow the web server in the DMZ (192.168.100.2) to receive only HTTPS traffic from the internet, and block everything else.

access-list 101 permit tcp any host 192.168.100.2 eq 443
access-list 101 deny ip any any

Line by line: the first rule allows (permit) TCP traffic (tcp) from any source (any) to the specific server host (host 192.168.100.2) on port 443, that is HTTPS (eq 443). The second line explicitly denies everything else (deny ip any any) — it is redundant with respect to the final implicit deny, but writing it explicitly makes the rule readable and checkable by whoever rereads it later, and it is good practice to show in a test. The order is correct because the specific rule (port 443) comes before the general denial: if the two lines were swapped, the deny ip any any would block everything, including legitimate HTTPS, because it would be the first match evaluated.

Exercise 3 — the path of a packet through NAT.

Brief: a PC with private address 192.168.20.15, source port 51000, contacts an external website on port 443. The company router does PAT with public address 203.0.113.10.

Step by step:

1. The PC builds the packet with source 192.168.20.15:51000, destination (the site’s address):443.
2. The packet arrives at the router, which applies PAT: the source address becomes 203.0.113.10, and the source port is remapped to a free port chosen by the router, for example 203.0.113.10:37500. The router records this correspondence in a translation table.
3. The translated packet goes out towards the internet; the external site sees the sender as 203.0.113.10:37500, not the private address of the PC — which in fact is never routable on the internet.
4. When the reply arrives, addressed to 203.0.113.10:37500, the router consults the translation table, remaps it to 192.168.20.15:51000 and delivers it to the original PC.

This exercise shows why PAT lets dozens or hundreds of private hosts share a single public address: the distinction between connections is left to the port, not the address.

Exercise 4 (optional) — where the web server goes and why.

The web server goes in the DMZ, a subnet separated from both the internal LAN and the internet by firewall rules. From the internet, only port 443 to that host is allowed (Exercise 2). From the internal LAN to the DMZ, wider access can be allowed for administering the server (for example SSH from the IT VLAN only). From the DMZ to the internal LAN, on the other hand, traffic must be denied by default: if the server were compromised, the attacker must not be able to use that position as a stepping stone to the rest of the network.

To build the network design for the maturità

The “complete network design” that appears in the second paper follows exactly the same order as this post: segmentation, addressing, routing, control points, exit, remote access. Whoever arrives at the test with this scheme in mind doesn’t have to invent a structure under time pressure — they just have to fill it with the data from the specific brief.

There is no dedicated practice test on networks and security on the site yet: at /simulazioni/ you’ll find those for maths, physics and admission tests — I say so openly. If you are still consolidating IP addressing, the prerequisite for this post is Year 4 subnetting: without knowing how to calculate a subnet, the addressing part of the network design doesn’t hold. And if in parallel you are preparing Computer Science with ER, relational schema and SQL, the method is the same: an orderly scheme before writing anything.

If the layered model isn’t clear, let’s start again from the post on ISO/OSI and TCP/IP.

Computer science lessons are online, one to one: with those preparing for the maturità we work on complete network design briefs, from segmentation to ACLs, so as to arrive at the exam with the scheme already automatic. To talk about your case, write to me: the first introductory call is free and lasts half an hour.