case study
Project Zero: Network Lab (Part 2)
Extended my Enterprise Homelab into a segmented network security lab by adding routing, LAN/DMZ separation, exposed services, and packet‑level visibility. Used it to study how real attacks traverse a network and how layered defenses change what an attacker can do.
##Lab Overview
-Hypervisor: VirtualBox using a dedicated NAT network plus internal LAN and DMZ segments behind pfSense.
-Goal: Design a realistic enterprise network, simulate network‑centric attacks against exposed services, and harden the environment with firewall rules, IDS, endpoint controls, and packet analysis.
##Virtual Machines
| VM / Host | Role |
| Windows Server | Domain Controller (AD, DNS, DHCP). |
| Windows client | Domain‑joined workstation used as a realistic user endpoint. |
| Linux client | Domain‑joined Linux workstation for mixed‑OS testing. |
| Security box | Central security tooling from Enterprise Lab (Wazuh, etc.). |
| Security workstation | Suricata and analysis box on the monitoring network. |
| Kali Linux | Attacker box for running network‑focused attack scenarios. |
| pfSense | Router and firewall separating WAN, LAN, and DMZ segments. |
| Web / DNS / FTP containers | Exposed services in the DMZ for attack and defense exercises. |
##What I Built
-Took the Enterprise Homelab and re‑architected it into a routed environment with distinct LAN and DMZ networks behind pfSense.
-Deployed web, DNS, and FTP services in a DMZ to create realistic external attack surfaces while keeping internal assets on a protected LAN.
-Captured and analyzed traffic with Wireshark and tcpdump to understand normal versus malicious patterns at the packet level.
-Implemented layered defenses with pfSense rules, Suricata IDS, Group Policy, Windows Firewall, and Wazuh file integrity monitoring, then validated them against real attack attempts.
##Tech Stack
-VirtualBox
-pfSense
-Windows Server, Windows client, Linux client
-Docker containers (web, DNS, FTP)
-Suricata
-Wireshark and tcpdump
-Windows Firewall, Group Policy, Wazuh FIM,
-Kali Linux
##Deep dives
-docs/01-network-architecture.md – Network architecture: IP addressing, routing, LAN/DMZ design, pfSense placement, and host roles.
-docs/02-network-attacks.md – Network attacks: reconnaissance, packet abuse, credential capture, password attacks, and service exploitation ran from the attacker box.
-docs/03-network-defense.md – Network defense: pfSense rules, Suricata detections, host hardening (GPO, Windows Firewall), Wazuh FIM, and examples of attacks that were blocked or detected.
Network Architectureopen →Network Attacksopen →Network Defensesopen →