Network segmentation — isolating different components from each other — is traditionally a multi-server concept, but meaningful segmentation is achievable even on a single VPS using Docker networks and firewall zones.
Why Segmentation Matters Even on One Server
Without segmentation, a compromise of one component (a web application) has unrestricted network access to every other component on the same server (database, internal APIs, other applications) — segmentation limits this "blast radius," containing a compromise's potential impact.
Using Docker Networks for Application-Level Segmentation
docker network create frontend-net
docker network create backend-netservices:
web:
networks:
- frontend-net
- backend-net
db:
networks:
- backend-net
admin-panel:
networks:
- backend-netThe web service can reach both networks; db and admin-panel are only on the internal backend-net, unreachable directly from outside or from any service not explicitly on that network.
Restricting Inter-Container Communication Further
docker network create --internal backend-net--internal prevents the network from having any external internet access at all, appropriate for a genuinely internal-only network like database communication.
Using iptables/nftables for Process-Level Segmentation (Non-Docker)
For services not running in Docker, use firewall rules to restrict which local processes/ports can communicate with which others — more manual than Docker's network abstraction, but achievable for a non-containerized setup.
Binding Sensitive Services to Localhost Only
# Database configuration
listen_addresses = '127.0.0.1'The simplest segmentation: services that only need local access (a database only accessed by a co-located application) should bind to localhost only, never listening on the server's public interface at all — see How to Configure Multiple Network Interfaces on a VPS for the broader concept.
Using firewalld Zones for More Granular Control
See How to Configure firewalld on AlmaLinux/Rocky Linux — firewalld's zone concept lets you define different trust levels for different logical network segments, even conceptually on a single server, if you're using it as your firewall.
Combining with Least Privilege Principles
See How to Implement the Principle of Least Privilege on a Linux VPS — network segmentation is one dimension of a broader least-privilege approach; combine with restricted file permissions and application-level access controls for genuine defense in depth.
Segmenting by Trust Level, Not Just Function
Consider segmenting based on trust/exposure level: internet-facing components in one segment, internal-only components in another, and particularly sensitive components (secrets management, admin interfaces) in the most restricted segment.
Testing Your Segmentation
docker exec web-container ping db-container
docker exec unrelated-container ping db-containerVerify segmentation actually works as intended — confirm intended communication paths work, and unintended ones genuinely fail, rather than assuming configuration is correct without testing.
Common Errors
Legitimate service-to-service communication unexpectedly blocked — review your segmentation design; sometimes overly aggressive segmentation breaks genuine required communication paths, requiring a more nuanced network topology.
Continue Reading
- How to Implement the Principle of Least Privilege on a Linux VPS
- How to Configure Multiple Network Interfaces on a VPS
- Docker Networking Explained: Bridge, Host & Custom Networks
Browse more articles in Advanced Security & Compliance.
