Before our group’s live attack/defence rounds, I ran three untested rows of our Blue Team Playbook’s detection matrix solo — playing attacker and defender at once to find real detection gaps before they’d cost us marks.
The 9 zones behind the firewall pfSense sits at the centre as firewall and router. WAN, LAN, CORP (VLAN 10), Blue Team / SOC (VLAN 20), MGMT (VLAN 99), DMZ (VLAN 30), Red Team / Guest (VLAN 40), WiFi-CORP (VLAN 50), WiFi-Guest (VLAN 60). Red Team to Blue Team direct access is denied both ways and logged. Each box opens a panel below the map with what the zone does and what changed on it during the project. Remote access — Remote access runs through OpenVPN on pfSense with FreeRADIUS authentication against Active Directory, tunnelling clients onto a dedicated 10.200.0.0/24 network that reaches the SOC segment only, not CORP, not DMZ, with the option to layer TOTP or privacyIDEA for MFA. RADIUS group membership, not just a valid login, determines which internal segments a VPN client can actually reach. 🔐 Remote access OpenVPN · 10.200.0.0/24 reaches SOC only, not CORP or DMZ Detection — Two independent views of the same activity: Suricata IDS on the GUEST, DMZ and CORP segments, correlated against Wazuh on the SOC segment. 🛰 Detection Suricata on 3 zones · Wazuh two independent views of one round WAN — The firewall's uplink, taking its address by DHCP from the campus NetLab pod. WAN the uplink to the campus network vtnet0 · DHCP from NetLab POD pfSense — pfSense sits at the centre as firewall and router, segmenting nine zones: router-on-a-stick, with Proxmox's VLAN-aware bridge handling trunking. Explicit deny rules enforce isolation between zones that should never touch, and every block is logged. Segmentation was designed around aliases, not one-off rules, so the deny policy could be reasoned about and audited as a whole. 🧱 pfSense fw01 · router-on-a-stick routing · NAT · Suricata IDS/IPS OpenVPN · Squid proxy alias-based deny · every block logged 802.1Q trunk on vtnet1 SW-CORE (conceptual) — the Proxmox bridge vmbr1, VLAN-aware, no IP address; every VLAN is trunked through it. 🔀 SW-CORE (conceptual) the Proxmox bridge vmbr1 802.1Q · VLAN-aware · no IP Red Team to Blue Team direct access: denied both ways and logged. The rule the whole design hangs off. ⛔ Red ↔ Blue no direct traffic, either way: denied both ways and logged THE RULE LAN — The firewall's base internal interface on vtnet1, the 802.1Q trunk into the Proxmox bridge vmbr1, which is VLAN-aware and has no IP address. The seven VLANs from CORP to MGMT are tagged on it. LAN base interface · the 802.1Q trunk 192.168.1.1/24 · vtnet1 CORP — The corporate LAN: Active Directory, DNS and the certificate authority on DC01, plus domain workstations. CORP VLAN 10IDS internal users and directory services 10.10.10.0/24 DC01-AD-DS-CA·AD · DNS · CA PC-CORP2·domain workstation comms01·InspIRCd chat Blue Team / SOC — The Blue Team SOC segment, which receives logs, alerts and detection evidence. Red Team to Blue Team direct access is denied both ways and logged, and GUEST can never reach it. Blue Team / SOC VLAN 20BLUE blue team · detect and respond 10.20.20.0/24 · SOC soc01·Ubuntu VM SIEM-Wazuh·+ EDR agents SYSLOG-ng·log collection RADIUS-FreeRADIUS·AAA via AD MGMT — A locked-down management plane reserved purely for firewall administration during the build. GUEST can never reach it. MGMT VLAN 99LOCKED firewall administration only 10.99.99.0/24 Admin workstation·during build only DMZ — The public-facing DMZ, reachable only per firewall policy and published services, and where the targets of the exercise lived. DMZ VLAN 30IDS public-facing, and the target 172.16.30.0/24 dmz01·Debian VM WEB-Apache·+ Flask app DB-MariaDB·least privilege VM 100·Metasploitable target Red Team / Guest — Red Team operates from VLAN 40 in a controlled, lab-safe manner. Red Team to Blue Team direct access is denied both ways and logged, and GUEST can never reach SOC or MGMT. Red Team / Guest VLAN 40RED · IDS red team · lab-safe only 10.40.40.0/24 · GUEST KALI-RED·attack box WiFi-CORP — Corporate wifi, in the design as its own segment. A design placeholder, with no devices configured. WiFi-CORP VLAN 50 corporate wifi · placeholder 10.50.50.0/24 · WIFICORP WiFi-Guest — Guest wifi, in the design as its own segment. A design placeholder, with no devices configured. WiFi-Guest VLAN 60 guest wifi · placeholder 10.60.60.0/24 · WIFIGUEST 9 zones, 7 of them VLANs on one 802.1Q trunk · Red ↔ Blue: no direct traffic, denied both ways and logged · click any box for what it does and what changed Click a zone, the firewall, or either corner box. Its panel opens below with what it does, what runs there, and what changed during the project, with links to the pages that cover it. The project also has its own page, with more of the evidence, kept up to date. Click a box on the map. Each panel says what that part of the network does, what runs there, and what changed on it during the project. The URL updates, so a panel can be linked to. ...