About the lab

In this lab I will be setting up a private network (using virtualization) and then secure it using a firewall. The firewall I’m using is pfSense which is a widely recognized, powerful, free and opensource firewall from Netgate. Although it is targeted for SOHO and mid-sized businesses, it is very often adopted by large enterprises because of its robust firewall capabilities and low cost to setup.

To extend pfSense’s capabilities and make it more secure, I added a VPN (using ProtonVPN and OpenVPN) and IDS/IPS (Snort) service to it!

My objectives for this lab

My primary objective with this lab is to get hands-on experience and understand how firewalls, vpn and IDS/IPS systems work. I have only read about these technologies but never got to set them up, so this was a perfect opportunity for me to go behind the scenes and dive into its nooks and crannies.

So far, this lab was an absolute fun to setup - especially when you see your firewall rules finally block some bad traffic, the VPN system hides your public IP and the IDS/IPS system block some suspicious traffic!

Lab Contents

• Setup a virtualized private network with pfSense as the firewall
  • Setup appropriate firewall rules (both WAN and LAN side)
  • Using pfSense to create a screened subnet (or DMZ) and isolate it using effective rules
  • Hosting a web server in the DMZ and making it available to the internet, using port forwarding
  • Enabling remote firewall administration
• Setup a VPN on pfSense and route all traffic through it
• Implement IDS/IPS capabilities on pfSense using Snort
  • Custom Snort rules to alert Nmap scanning
• Setup a dynamic DNS (will add soon, work in-progress …..)
• Setup a captive portal access for visitors (will add soon, work in-progress …..)

Lab Setup

ProtonVPN service is used for VPN connectivity. Enabled by OpenVPN

Setting up pfSense Firewall

I might purchase a NetGate SG-1100 firewall appliance in the future for my home setup, but for now I’m using virtual machines to setup the pfSense firewall. So yeah this can be considered a virtual firewall.

Head over to pfSense’s website and download the ISO image of your choice. I choose the AMD 64-bit.