Cybersecurity Home Lab

Firewall &
Network Segmentation

A production-grade virtual firewall infrastructure powered by pfSense CE, isolating five security zones behind stateful packet inspection, outbound NAT, and Unbound DNS — all running on VirtualBox.

7
Interfaces
5
Security Zones
25+
Firewall Rules
4
Core Services
Technical Specifications

Architecture at a Glance

Built on pfSense CE 2.7.x (FreeBSD 14.0-RELEASE) with resource allocation and multi-NIC topology.

🛡️
pfSense CE 2.7.x
Firewall Engine
💻
2 vCPU / 1 GB
VM Resources
📦
VirtualBox
Hypervisor
🌐
7 NICs
Network Interfaces
Live Network Topology

Architecture Diagram

Packet flow through the firewall — from the Internet through pfSense and into each segmented security zone.

☁ INTERNET em0 — NAT pfSense FIREWALL MANAGEMENT 10.0.0.0/24 em1 WebGUI Ubuntu VM CYBER RANGE 10.10.10.0/24 em2 WAF Targets ACTIVE DIR 10.20.20.0/24 em3 DC01 Win11 SECURITY 10.30.30.0/24 em4 Wazuh Suricata MALWARE 10.40.40.0/24 em5 🔒 ISOLATED FLARE-VM Cuckoo TRAFFIC FLOW Management — Full access Cyber Range — Limited cross-subnet Active Dir — Isolated from Cyber & Malware Security — Receives all log streams Malware — Zero cross-VLAN (sandboxed)
Network Segmentation

Security Zone Breakdown

Each interface maps to an isolated internal network with unique CIDR addressing, DHCP pools, and access policies.

Interface Zone Subnet Gateway DHCP Pool Access Policy
em0 WAN DHCP (NAT) Variable Upstream External internet gateway
em1 Management 10.0.0.0/24 10.0.0.1 .100 – .200 Full admin access to all zones & WebGUI
em2 Cyber Range (DMZ) 10.10.10.0/24 10.10.10.1 .100 – .200 Deliberately vulnerable systems & CTF targets
em3 Active Directory 10.20.20.0/24 10.20.20.1 .100 – .200 Internet ✓ | Isolated from Cyber & Malware
em4 Security 10.30.30.0/24 10.30.30.1 .100 – .200 Receives syslog/SIEM from all zones
em5 Malware 10.40.40.0/24 10.40.40.1 Disabled 🔒 Zero cross-VLAN — fully sandboxed
em6 HOST_MGMT 192.168.56.0/24 192.168.56.2 Disabled (Static) Trusted physical Kali administration link
Stateful Firewall Policy

Security Rule Matrix

Top-to-bottom, first-match-wins rule processing with default-deny posture across all interfaces.

🛡
Management (em1)
10.0.0.0/24
  • PASS Admin hosts → WebGUI & SSH
  • PASS DNS queries → pfSense resolver
  • PASS Outbound Internet access
  • PASS Full access to all internal subnets
  • DENY Default deny catch-all
🌐
Cyber Range / DMZ (em2)
10.10.10.0/24 — Demilitarized Zone
  • PASS Inbound traffic to Web & WAF services
  • PASS Security logs → Wazuh/SIEM (514/1514)
  • DENY ALL traffic initiated to Management net
  • DENY Block initiated access to Active Directory
  • DENY Block access to Malware sandbox
  • PASS Outbound Internet for updates (scoped)
🏢
Active Directory (em3)
10.20.20.0/24
  • PASS DNS → local resolver
  • PASS AD audit logs → SIEM
  • DENY Block access to Management net
  • PASS Internet for WSUS / NTP
📡
Security Ops (em4)
10.30.30.0/24
  • PASS DNS → pfSense
  • PASS SIEM scanners → internal hosts
  • PASS Internet for threat intel feeds
☣
Malware Sandbox (em5)
10.40.40.0/24
  • PASS DNS (intercepted / sinkholed)
  • DENY ALL inter-VLAN access blocked
  • DENY Direct WAN access blocked
  • PASS Optional controlled detonation
📜
Global Principles
All Interfaces
  • DENY Default deny all inbound & inter-subnet
  • PASS Stateful return traffic auto-permitted
  • PASS Top-to-bottom, first-match-wins
  • DENY Malware zone — zero cross-VLAN
Implementation Roadmap

Structured Learning Path

Follow this five-phase roadmap to build a deep understanding and successfully deploy the entire lab.

Phase 1 — Understand
Conceptual Architecture & Design
Study the design rationale, network topology diagrams, and master IP allocation plan. Understand why pfSense acts as the central gateway with 7 adapters emulating enterprise hardware.
Phase 2 — Provision
Hypervisor & Base OS Setup
Create VirtualBox VMs with proper resource allocation. Install pfSense CE, assign console interfaces (em0–em6), and deploy the Ubuntu management workstation.
Phase 2.5 — Configure
Post-Wizard Configuration Protocol
Rename interfaces, assign static gateway IPs, enable DHCP pools, verify internet egress, create network aliases, and take a baseline VirtualBox snapshot.
Phase 3 — Enforce
WebGUI Services & Policy Enforcement
Configure DHCP scopes, implement stateful default-deny firewall rules, set up outbound NAT & port forwarding, and harden Unbound DNS resolver with AD domain overrides.
Phase 4 — Verify
Validation & Diagnostics
Execute cross-subnet ping tests, Nmap scans, and WebGUI access checks. Use the troubleshooting guide for DHCP failures, DNS loops, and adapter mismatches.
Repository Structure

Project File Organization

Every configuration decision, installation step, and validation procedure is documented and version-controlled.

. ├── README.md # Master Build Documentation & Architecture ├── assets/ │ ├── home_lab_network_architecture.png # Network architecture diagram │ └── firewall_traffic_flow.png # Detailed firewall traffic flow diagram ├── architecture/ │ ├── network-diagram.drawio # Editable network topology source │ ├── topology.png # Rendered topology diagram │ ├── topology.svg # Vector topology diagram │ ├── ip-plan.md # IP allocation & subnetting plan │ └── design-rationale.md # Design decisions & isolation rationale ├── installation/ │ ├── setup-vbox-vm.sh # Automated 7-adapter provisioning script │ ├── virtualbox.md # VirtualBox VM creation guide │ ├── kali-network-setup.md # Physical Kali host access (HOST_MGMT) │ ├── pfsense-install.md # pfSense ISO installation walkthrough │ ├── interface-assignment.md # NIC mapping (em0–em6) │ └── dhcp.md # DHCP scope configuration ├── configuration/ │ ├── firewall-rules.md # Firewall rules matrix & policy logic │ ├── dns-resolver.md # Unbound DNS & hardening │ ├── nat.md # Outbound NAT & port forwarding │ └── aliases.md # Firewall aliases definition ├── validation/ │ ├── connectivity.md # Inter-VLAN routing & ping matrix │ └── troubleshooting.md # Diagnostic solutions └── backup/ └── config.xml # Exported pfSense configuration