Lion Cipher Lab

Set up a pfSense firewall in a lab (a real network gateway you own)

• Cyber / Security Engineer
• Intermediate
• ~2 hours (mostly two VM installs running in the background)
• Free · no account required

Why it matters

Every home, office, hospital, and data center that reaches the internet has a box at the edge that decides what traffic may cross between the inside and the outside. That box is a network FIREWALL and GATEWAY, and pfSense is one of the most widely used ways to build one -- it is free, open-source software that turns a plain computer (or a VM) into a full-featured firewall/router. This is a different animal from the host firewalls you may have met (ufw or nftables), which guard a SINGLE machine's own traffic. A network firewall sits between whole networks: on one side the WAN (the untrusted…

What you'll learn

• what a network firewall, a gateway, an interface, and a WAN/LAN split actually are, in plain words
• the difference between a NETWORK firewall appliance (pfSense) and a HOST firewall (ufw/nftables) that only guards one machine
• where to download pfSense Community Edition (CE) for FREE and install it as a VirtualBox VM
• building two isolated virtual networks in VirtualBox (a NAT upstream for WAN, an Internal Network for LAN) so the lab cannot leak
• creating a pfSense VM with two network adapters and letting pfSense auto-assign WAN and LAN
• how pfSense hands out addresses with a DHCP server and answers names with a DNS resolver, out of the box
• what NAT is and why many private LAN machines can reach out through one WAN address
• reading firewall rules the way the appliance does: top-to-bottom, first-match, per interface, with an implicit default-deny at the bottom
• writing a default-deny LAN policy that allows only the traffic you actually need
• proving it: from a client VM behind the firewall, showing an allowed rule passes and a blocked rule really blocks

Steps in this lab

1. First: this is YOUR lab, and the client is sealed behind the firewall
2. The words you need first: firewall, gateway, WAN/LAN, interface, rule, default deny, DHCP, DNS, NAT, segmentation
3. Install VirtualBox (the free hypervisor) on your own machine
4. Download the FREE pfSense Community Edition installer
5. Build the two isolated virtual networks and create the pfSense VM
6. Install pfSense onto the VM
7. Let pfSense assign WAN and LAN, and note the LAN address
8. Create the client VM behind the firewall and let DHCP give it an address
9. Open the pfSense web interface from the client and finish first-time setup
10. How pfSense reads rules: first match, per interface, implicit default-deny
11. Write a default-deny LAN policy that allows only what you need
12. Prove it: from the client, show an allowed rule passes and a blocked rule blocks
13. What you built, how to keep it, and where to go next

Open the full interactive lab →