03Personal Lab
Personal Lab · Network Security · Blue Team
Segmented Network & Monitoring Lab
A multi-zone network with pfSense, DMZ and internal VLANs, plus Snort IDS and a Wazuh SIEM — the defensive view of the same attacks I practice offensively.
pfSenseVLANs / DMZSnortWazuh
Overview
A functional multi-zone network built to give me the defensive perspective on the same kinds of attacks I practice offensively — segmentation, firewall rules, intrusion detection and log-driven investigation.
Objective
See what detection and monitoring actually observe when an attack happens, so offensive work is informed by how the blue team would see it.
Architecture
Network topology
Segmented zones behind pfSense.
Internet
Untrusted external network.
Detection pipeline
From raw activity to an investigation.
Network Traffic
Packets crossing the monitored segments.
Technologies
- pfSense
- VLAN segmentation
- DMZ
- Inter-zone firewall rules
- Snort IDS
- Wazuh SIEM
What I built
- A functional multi-zone network with pfSense acting as firewall/router.
- Separate DMZ and internal VLANs with enforced inter-zone routing and firewall rules.
- Snort deployed as an IDS for network intrusion detection.
- A Wazuh SIEM collecting system and application logs for alerting and investigation.
Security concepts
- Network segmentation & DMZ design
- Inter-zone firewall policy
- Intrusion detection (IDS)
- Log collection & SIEM alerting
- Attack vs. detection correlation
What I learned
- How segmentation and firewall rules contain movement between zones.
- What an IDS like Snort actually flags on the wire versus what stays quiet.
- How logs become alerts in a SIEM, and what an investigation starts from.
- Reading the same attack from both sides — offensive action and defensive signal.