CloudLabBox
Try the free demo

Network+ lab 22 of 27

Edge firewall and DMZ screened subnet with pfSense

Build a stateful firewall with three zones on pfSense. You set it up from the console, manage it through its web GUI, add a screened subnet for a public web server, publish the server with a port forward, and write the rules that keep the DMZ from ever reaching the inside network.

Run this lab

It needs Lite: its 5 nodes are set to 5 vCPU and 4,608 MB in total. That fits the free demo too.

In your workspace: Shared, then CompTIA Network Plus N10-009 guided labs, then 22 - Edge firewall and DMZ screened subnet with pfSense

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 90 minutes
Nodes need
5 vCPU, 4,608 MB
Smallest plan
Lite

The scenario

Harbour Logistics is putting its public website in-house. The web server must be reachable from the internet, but if it's ever compromised, it must not become a way into the office network. The answer is a screened subnet (DMZ): a third firewall zone between the internet and the inside. You'll build it on FW1, a pfSense firewall: first from its console, then from its web GUI.

ZoneFW1 interfaceAddressHosts
WAN (untrusted)em0198.51.100.2/29, gateway 198.51.100.1ISP router; internet user INET1 203.0.113.10
LAN (trusted)em110.10.10.1/24ADMIN 10.10.10.10 (management desktop)
DMZ (screened subnet)em2172.16.50.1/24WEB1 172.16.50.10 (HTTP)

Policy: LAN may go anywhere. The DMZ may reach the internet (for updates) but never the LAN. The internet may reach only the web server, on TCP 80, through the firewall's public address 198.51.100.2.

pfSense's factory login for the web GUI is admin / pfsense. In real life you'd change it at once; here the setup wizard offers to.

What you’ll practise

  • Explain stateful firewalls, zones and the screened subnet (DMZ)
  • Assign interfaces and addresses from a firewall's console
  • Manage the firewall through its web GUI from an admin workstation
  • Add a third interface as a DMZ, and write ordered allow and block rules
  • Publish a DMZ server with a port forward (destination NAT) and outbound NAT
  • Test the policy from the inside, the DMZ and the internet

The tasks

  1. Prepare the test hosts
  2. Set up the interfaces from the console
  3. Log in to the web GUI
  4. Add the DMZ interface
  5. Write the DMZ rules
  6. Publish the web server
  7. Test the whole policy

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Edge firewall and DMZ screened subnet with pfSense5 nodes, 4 links. Every link is listed as text below the diagram.FW1ISPINET1ADMINWEB1e0Gi0/0Gi0/1eth0e1eth0e2eth0
5 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • FW1 e0 to ISP Gi0/0
  • FW1 e1 to ADMIN eth0
  • FW1 e2 to WEB1 eth0
  • ISP Gi0/1 to INET1 eth0
Nodes in Edge firewall and DMZ screened subnet with pfSense, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
FW1Netgate pfSense CEpfsense-CE-2.5.2-RELEASE1 vCPU, 1,024 MB
ISPCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
INET1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
ADMINEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 2,048 MB
WEB1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CompTIA Network Plus N10-009 guided labs.

  3. Open 22 - Edge firewall and DMZ screened subnet with pfSense and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Network+ labs

All Network+ labs

Related labs in other courses

CloudLabBox is independent of CompTIA, Cisco and Netgate. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.