PROJECT NOTES / 01
pfSense Security & Monitoring Lab
One virtual lab. Three network zones. A firewall, a monitoring stack and controlled tests to understand how they behave together.
The question behind the project
Separating services is only useful if the right traffic can still cross the boundary. I wanted a lab where I could configure those boundaries, keep the hosts visible and examine the effects of controlled security tests.
What I built
- Built a VMware environment around pfSense, with WAN, LAN and DMZ interfaces. Moved the Ubuntu monitoring server into the DMZ and adjusted inter-zone filtering.
- Installed Zabbix and its agents, monitored pfSense over SNMP, and connected Grafana to the collected metrics. The migration meant revisiting host addresses, agent settings and firewall exceptions.
- Integrated Suricata, began with IDS observation and examined the later host-blocking behaviour. Used Nmap and hping3 from Kali Linux for controlled reconnaissance and traffic tests.
What came out of it
The lab was virtualized, segmented and monitored. The materials show collected metrics, Suricata alerts and blocked-host entries. They also show reduced monitoring visibility during testing—a useful reminder that monitoring depends on the network carrying it.
What the evidence does—and doesn’t—say
A sender-side “100% packet loss” result does not establish a prevention rate. The demonstrated Suricata host-blocking mode should not be confused with a verified inline IPS deployment. The repository preserves the test contexts and their limits.
What I would improve next
A separate monitoring network, SIEM integration and pfSense high availability are proposed improvements, not completed work.
From the project
Select a capture to inspect it.
07 / CONTACT
Let’s start with
a conversation.
Have a PFE internship in cybersecurity, networks or infrastructure security? I’d be glad to hear about the work and the team.
Marrakech, Morocco