Network Segmentation Diagram
To build a network segmentation diagram, group your servers by trust level and draw firewall rules between each zone. A clear network segmentation diagram shows which subnets can talk to each other and which ports stay blocked. Teams often start by splitting public web apps from private data stores. When subnet rules are too broad, a breach in one zone can spread across the whole system. How to map zones in a network segmentation diagram Start by listing every server, database, and user group
Network Segmentation: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
To build a network segmentation diagram, group your servers by trust level and draw firewall rules between each zone. A clear network segmentation diagram shows which subnets can talk to each other and which ports stay blocked. Teams often start by splitting public web apps from private data stores. When subnet rules are too broad, a breach in one zone can spread across the whole system.
How to map zones in a network segmentation diagram
Start by listing every server, database, and user group in your cloud or data center. Group these assets into distinct zones based on what they do and what data they hold. A standard map has a public zone, an app zone, and a private data zone.
Draw boxes for each subnet and label the IP ranges clearly on the map. Next, draw arrows between the boxes to show the exact direction of allowed network traffic. Label each arrow with the protocol and port number that the firewall permits.
Keep management tools in their own separate zone away from daily user traffic. Admins should log in through a single controlled path rather than from any open network. Review these paths with your team to find and remove any wide-open routes.
What network zones solve and what they leave open
Network zones stop attackers from moving sideways across your servers after an initial break-in. If a web server gets compromised, firewall rules block direct network paths to unrelated systems. This layout limits the blast radius of a network attack and shrinks your audit scope.
Still, a firewall only checks the source IP, destination IP, and port number. Once a user or app passes the firewall check, the network allows the session through. The subnet rule cannot see what commands or queries run inside that open session.
An engineer with valid credentials can still run a bad query that drops a table. A shared database user can still pull raw emails, phone numbers, or card numbers in bulk. Network boundaries decide which host can reach a port, not what happens inside the session.
Network Segmentation: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Why teams pair network maps with session controls
Static network diagrams show how packets move, but they do not track human identity. When ten engineers share one admin subnet, network logs only show the subnet IP address. You cannot tell which person ran a specific command or changed a system setting.
Teams also struggle to keep firewall rules updated as cloud servers spin up and down. Engineers often request broad subnet access just to fix an urgent bug in production. Over time, these temporary exceptions turn a clean zone map into a tangled web.
To close this gap, teams pair network zones with controls that inspect traffic in flight. You need a way to tie every single query and command to an individual user. Checking each action at runtime stops risky queries and rewrites matched sensitive fields in results.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
What should a network segmentation diagram include?
Include all subnets, VLANs, firewall boundaries, and the direction of allowed traffic between zones. Label every link with the allowed ports and protocols so teams can verify firewall rules.
How often should teams update their network diagram?
Update your diagram whenever you add a new service, change subnet routes, or edit firewall rules. Run a scheduled check every quarter to make sure the map matches your live setup.
Does network segmentation replace database access controls?
No, network segmentation only restricts which IP addresses can reach a database port. You still need role checks and query controls to govern what logged-in users can run.