================================================================================
  ACME CORP NETWORK TOPOLOGY — Firewall & Zone Architecture
  Document: NET-DIAG-2025-003    Last updated: 2025-10-01
================================================================================


                           +-----------------+
                           |   INTERNET      |
                           |  (Untrusted)    |
                           +--------+--------+
                                    |
                                    | Public IPs: 198.51.100.0/24
                                    |
                           +--------+--------+
                           |  EDGE FIREWALL  |
                           |   fw-edge-01    |
                           +--------+--------+
                                    |
                 +------------------+------------------+
                 |                                     |
        +--------+--------+                   +--------+--------+
        |      DMZ        |                   |   VPN GATEWAY   |
        | 192.168.10.0/24 |                   |  192.168.99.1   |
        |                 |                   +---------+-------+
        | - Web servers   |                             |
        | - Reverse proxy |                    Remote employees
        | - Mail gateway  |                    & contractors
        +--------+--------+
                 |
        +--------+--------+
        | INTERNAL FIREWALL|
        |   fw-core-01     |
        +--------+---------+
                 |
    +------------+------------+------------------+
    |            |            |                  |
+---+----+ +----+-----+ +----+-----+    +------+------+
|INTERNAL| |   DB      | |  MGMT    |    | DEV/STAGING |
|NETWORK | |  ZONE     | |  ZONE    |    |    ZONE     |
|10.0.1.0| |10.0.2.0   | |10.0.5.0  |    | 10.0.10.0   |
|  /24   | |  /24      | |  /24     |    |   /24       |
|        | |           | |          |    |             |
|- App   | |- MySQL    | |- Ansible | |- CI/CD server |
|  servers| |- Postgres | |- Nagios  |    |- Test DBs  |
|- File  | |- Redis    | |- Jump    |    |- Sandbox   |
|  server | |  cluster  | |  box     |    |  envs      |
|- LDAP  | |- Backups  | |- SIEM    |    |            |
+--------+ +----------+ +----------+    +------------+


================================================================================
  CURRENT FIREWALL RULES BETWEEN ZONES (fw-core-01)
================================================================================

  SOURCE ZONE          DEST ZONE           PROTOCOL/PORT     ACTION
  -------------------------------------------------------------------------
  INTERNET        -->  DMZ                 TCP/80, TCP/443    ALLOW
  INTERNET        -->  DMZ                 TCP/25 (SMTP)      ALLOW
  INTERNET        -->  DMZ                 ALL ICMP            ALLOW
  INTERNET        -->  INTERNAL            *                   DENY
  INTERNET        -->  DB ZONE             *                   DENY

  DMZ             -->  INTERNAL            TCP/8080, TCP/8443 ALLOW
  DMZ             -->  DB ZONE             TCP/3306            ALLOW  [!]
  DMZ             -->  DB ZONE             TCP/5432            ALLOW  [!]
  DMZ             -->  DB ZONE             TCP/6379            ALLOW  [!]
  DMZ             -->  MGMT ZONE           *                   DENY
  DMZ             -->  INTERNET            TCP/80, TCP/443    ALLOW
  DMZ             -->  INTERNET            TCP/53, UDP/53     ALLOW

  INTERNAL        -->  DMZ                 TCP/80, TCP/443    ALLOW
  INTERNAL        -->  DB ZONE             TCP/3306            ALLOW
  INTERNAL        -->  DB ZONE             TCP/5432            ALLOW
  INTERNAL        -->  DB ZONE             TCP/6379            ALLOW
  INTERNAL        -->  MGMT ZONE           TCP/22              ALLOW
  INTERNAL        -->  INTERNET            *                   ALLOW  [!]

  DB ZONE         -->  INTERNAL            *                   DENY
  DB ZONE         -->  DMZ                 *                   DENY
  DB ZONE         -->  INTERNET            *                   ALLOW  [!]
  DB ZONE         -->  MGMT ZONE           *                   DENY

  MGMT ZONE       -->  INTERNAL            *                   ALLOW  [!]
  MGMT ZONE       -->  DB ZONE             *                   ALLOW  [!]
  MGMT ZONE       -->  DMZ                 *                   ALLOW  [!]
  MGMT ZONE       -->  INTERNET            *                   ALLOW  [!]
  MGMT ZONE       -->  DEV/STAGING         *                   ALLOW  [!]

  DEV/STAGING     -->  INTERNAL            *                   ALLOW  [!]
  DEV/STAGING     -->  DB ZONE             TCP/3306, TCP/5432 ALLOW  [!]
  DEV/STAGING     -->  INTERNET            *                   ALLOW  [!]
  DEV/STAGING     -->  DMZ                 *                   DENY

  VPN GATEWAY     -->  INTERNAL            *                   ALLOW  [!]
  VPN GATEWAY     -->  DB ZONE             *                   ALLOW  [!]
  VPN GATEWAY     -->  MGMT ZONE           *                   ALLOW  [!]
  VPN GATEWAY     -->  DMZ                 TCP/22              ALLOW


================================================================================
  [!] = FLAGGED: Potential least-privilege violation — review required
================================================================================

  KNOWN ISSUES (from last audit 2025-07-15):
  -------------------------------------------------------------------------

  1. DMZ --> DB ZONE:  Direct database access from DMZ violates defense in
     depth. Web servers in the DMZ should connect to application servers in
     the INTERNAL zone, which then query the database. A compromised web
     server currently has direct access to MySQL, PostgreSQL, AND Redis.

  2. MGMT ZONE: Has unrestricted access to ALL zones. Management traffic
     should be limited to SSH (TCP/22), HTTPS (TCP/443), and SNMP
     (UDP/161). Current rules allow any protocol and port.

  3. DB ZONE --> INTERNET: Database servers should NEVER have direct
     internet access. Outbound traffic should route through a proxy for
     package updates only. Current rule allows unrestricted egress.

  4. INTERNAL --> INTERNET: Unrestricted outbound. Should be limited to
     HTTP/HTTPS through a proxy, DNS, and NTP at minimum. Allows potential
     data exfiltration and C2 communication.

  5. VPN GATEWAY: VPN users get full access to INTERNAL, DB, and MGMT
     zones. No segmentation by user role. A compromised VPN account can
     reach everything.

  6. DEV/STAGING --> DB ZONE: Dev/staging servers can reach production
     databases. This violates environment separation and risks accidental
     or malicious data access.

  7. DEV/STAGING --> INTERNAL: Unrestricted access between dev and
     production internal networks. Lateral movement from a compromised
     dev server can reach production systems.

  8. No rate limiting on any zone-to-zone traffic.

  9. No IDS/IPS inspection between zones.

 10. No logging configured on fw-core-01 for denied or allowed traffic.

================================================================================