We saw in this chapter some pretty complicated networks. We also saw that building firewalls and QoS for such networks is not so complicated. However, it is very important to draw the network and identify security breakpoints to be able to create a firewall that will protect your network.

In my opinion, the most important things about security are knowing your network, building it in an intelligent manner and with security in mind, and most of all, understanding how packets flow in your network.

Understanding the flow of the packets in the network is essential for people who want to build good firewalls and intelligent QoS. I've seen simpler networks than the ones presented here with very complicated firewalls, which had rules that didn't belong there or that could be reduced to much simpler ones.

I've also seen some networks that were badly thought out from the beginning. For instance, think about the second example of this chapter and how it would be if we place one server on the customer interface, some customers in the server farm switch, etc. This would complicate our firewalls a lot. Also, a badly thought out subneting of the network would mean generating kilometers of firewall rules and a lot of tc filters.

It may happen at some point that you have to administer a network badly subneted and badly thought out by others. To be honest, taking each part of it and building security is way more difficult and time consuming than redrawing the network, renumbering IP address, and rebuilding the firewalls. Of course, all of these operations must be done always thinking about minimal downtime for servers and customers.