Build a Zero-Trust Private Network

What you will build

A network where compromising one machine does not hand over the rest.

Starting point: you only need a Vultr account. This challenge is self-contained, so you can do it without having done any other.

The requirements

• Web, app and database tiers on a VPC, with only the web tier public
• No public SSH anywhere: administration through a VPN or bastion with key-only access
• Instances without public IPs reach the internet through a NAT gateway
• Firewall groups that allow only the exact flows each tier needs
• Mutual TLS or an equivalent authenticated channel between the app and database tiers
• Central logs showing every administrative login

Attack your own setup

1. Scan the public address from outside and list every open port
2. Try to reach the app and database tiers directly
3. From a compromised web tier, try to reach other tiers on ports you did not allow
4. Document what failed, which is the point, and what succeeded, which you then fix

nmap -Pn -p- YOUR_PUBLIC_IP
nmap -Pn -p 22,3306,5432 PRIVATE_APP_IP

How you will be judged

• The scan shows only the ports you intended
• The rules are minimal, with a reason for each one
• A written threat model, even a short one
• Findings fixed and re-tested

Only scan systems you own. Destroy everything you created when you are done so you are not billed for it.