Implementing and Validating a Zero Trust Network Architecture in a Reproducible, Namespace-Based Enterprise Testbed

Zero Trust Architecture(ZTA) remains a widely discussed paradigm in security literature;however,most existing work is theoretical,survey-based,or derived from reports by large organizations,making it difficult for students and independent researchers to reproduce.This paper presents a low-cost, fully reproducible testbed that acts just like a small company network consisting of administrative, corporate, and IoT/CCTV segments,created using Linux network namespaces instead of dedicated virtual machines or hardware. A default-deny Zero Trust firewall policy,which follows the NIST SP 800-207 Zero Trust standard,was implemented and measured against a flat network baseline.Before applying the policy, all segments could freely communicate with one another. After implementing the Zero Trust policy,all non-permitted traffic was completely blocked,while explicitly authorized traffic such as SSH access from the administrative to the corporate zone,operated exactly as expected during testing. A particularly notable finding came up when we looked at the system like an attacker testing using Nmap rather than merely blocking access to a visible target, the Zero Trust policy caused protected hosts to appear entirely non-existent to standard network scans, indicating a stronger and more practical form of protection than simple port-level filtering. This work offers a reproducible,low-cost methodology for building and real-world testing of validating Zero Trust principles in an academically accessible framework.