Vlan

In Part 10, I added the Windows identity layer: Active Directory, DNS, DHCP, and a domain-joined client. In this part, I turn the lab from “everything can reach everything while I build” into an explicit firewall policy. The goal is not to make the rules fancy. The goal is to make every allowed path explainable. What I Built I replaced the temporary build-phase allow rules with a segmented pfSense policy: Default posture: deny by default Management: Tailscale + break-glass LAN/WAN access Jumpbox: Alpine SSH path into Kali Client VLAN: AD, DNS, Wazuh, Windows Update only Container VLAN: Docker host + n8n explicit egress only Honeypot VLAN: Wazuh telemetry only Pentest VLAN: no internet egress Isolated VLAN: no ingress, no egress ‹ › ...

In Part 9, I built the malware-analysis segment. In this part, I add the Windows identity layer: Active Directory, DNS, DHCP, and the first domain-joined client. This is where the lab becomes useful for Windows telemetry, Sysmon, Group Policy, domain logons, Atomic Red Team tests, and later Wazuh detection work. What I Built Server: Windows Server 2022 Desktop Experience VM name: prod-winserver VLAN: 20 / DEFENCE IP: 10.10.20.20/24 Gateway: 10.10.20.1 Domain: ad.plumy.lab NetBIOS: AD Roles: AD DS, DNS, DHCP Client VLAN: 60 / CLIENT Client test: domain join and ad\plumy login Telemetry: Wazuh agent on DC and client ‹ › ...

In Part 4, I created the Docker platform. In this part, I add the first classic offensive-security pair: Kali as the attacker and Metasploitable as the intentionally vulnerable target. Both machines live in the PENTEST VLAN. This keeps practice traffic away from the rest of the lab until I deliberately allow a path through pfSense. What I Built Segment: PENTEST VLAN: 40 Gateway: 10.10.40.1 Kali IP: 10.10.40.102 Metasploitable: 10.10.40.100 ‹ › ...

In Part 2, the Alpine jumpbox gave me a stable path into pfSense. In this part, I turn the flat internal LAN into a segmented lab. The goal is to create the VLAN interfaces, give each segment a gateway IP, enable temporary DHCP where it helps installation, and leave the final firewall policy for a dedicated firewall-rules post. What I Built Parent interface: vtnet1 VLAN 10: SIEM VLAN 20: DEFENCE VLAN 30: CONTAINER VLAN 40: PENTEST VLAN 50: HONEYPOT VLAN 60: CLIENT VLAN 99: ISOLATED Current addressing: ...