Segmentation

In Part 10, I added the Windows identity layer: Active Directory, DNS, DHCP, and a domain-joined client. In this part, I turn the lab from “everything can reach everything while I build” into an explicit firewall policy. The goal is not to make the rules fancy. The goal is to make every allowed path explainable. What I Built I replaced the temporary build-phase allow rules with a segmented pfSense policy: Default posture: deny by default Management: Tailscale + break-glass LAN/WAN access Jumpbox: Alpine SSH path into Kali Client VLAN: AD, DNS, Wazuh, Windows Update only Container VLAN: Docker host + n8n explicit egress only Honeypot VLAN: Wazuh telemetry only Pentest VLAN: no internet egress Isolated VLAN: no ingress, no egress ‹ › ...

In Part 2, the Alpine jumpbox gave me a stable path into pfSense. In this part, I turn the flat internal LAN into a segmented lab. The goal is to create the VLAN interfaces, give each segment a gateway IP, enable temporary DHCP where it helps installation, and leave the final firewall policy for a dedicated firewall-rules post. What I Built Parent interface: vtnet1 VLAN 10: SIEM VLAN 20: DEFENCE VLAN 30: CONTAINER VLAN 40: PENTEST VLAN 50: HONEYPOT VLAN 60: CLIENT VLAN 99: ISOLATED Current addressing: ...