At STI-TEC, I took responsibility for a network-security redesign spanning three sites in three states. The environment combined site-to-site VPNs with dedicated Layer 2 connectivity between the two main sites. It was unfamiliar territory, and I had to learn how the environment worked while figuring out how to improve it.
The network already had VLANs, but broad any-to-any firewall policies allowed traffic between segments. My work involved understanding what actually needed to communicate and replacing those broad permissions with narrowly scoped rules.
Learning the environment #
That required detailed traffic analysis. I reviewed firewall logs to identify the source and destination addresses, ports, and services behind the connections. I worked through which traffic supported legitimate functions and which access could be removed or restricted. Across three interconnected sites, understanding those dependencies took time. The redesign ran for approximately six months, with much of that effort going into learning the environment and working through its access requirements.
I used my OPNsense homelab to teach myself network segmentation, reverse-proxy design, and controlled management access. Through independent study and experimentation, I developed approaches that I then adapted to STI-TEC’s FortiGate environment across three connected sites.
Designing the access boundaries #
The resulting design separated services according to how they needed to be accessed:
-
An external DMZ contained the reverse proxy.
-
An internal DMZ contained the hosted services behind that proxy.
-
A separate internal server network contained services that were not publicly accessible, including through the proxy.
-
Dedicated IoT and management networks separated those functions, with administrative access through jumpboxes.
Secure access to the development network #
I also addressed access to the development network. I configured an internal-only WireGuard VPN for approved laptops, requiring an approved configuration to connect. Its endpoint was reachable only from the on-site corporate network or through the main company VPN. This allowed developers to use one laptop for both environments while keeping development access behind a separate, controlled connection.
Protecting applications at the proxy #
I used NGINX/Traefik reverse proxies as controlled entry points for hosted applications across the segmented networks. The proxy layer provided application-layer inspection, with CrowdSec adding brute-force detection and shared threat intelligence. Applications gained those protections without requiring changes to the applications themselves. I terminated TLS at the proxies, secured upstream connections using trusted internal certificates, and automated certificate replacement and deployment with Ansible.
I owned the firewall policies, VLANs, and VPN configuration, using traffic logs to refine the rules around the connections the environment needed.
Assessment and outcome #
The resulting network formed part of the infrastructure evaluated in STI-TEC’s successful C3PAO CMMC Level 2 assessment. During the assessment, the lead assessor told me it was the best network they had seen. That feedback was particularly meaningful after months spent working through the details.