Technical Writeup
Home Network Security Lab
pfSense · VLAN Segmentation · Zeek Traffic Analysis · Wireshark
Mirrors the segmented network architecture found in enterprise environments: separate VLANs for different trust zones, strict inter-VLAN routing enforced by firewall rules, and passive traffic analysis to validate that isolation is actually working, not just assumed. Built to understand network segmentation decisions from the ground up after years of monitoring enterprise networks without designing them.
Techniques Practiced
- 5-VLAN design: Management (high trust), Servers, User Workstations, IoT/Untrusted (internet-only, zero RFC1918 access), DMZ
- pfSense firewall rule logic: top-down first-match evaluation; specific denies before broad allows; common misconfiguration identified and corrected
- Zeek conn.log analysis: confirmed allowed traffic, verified IoT isolation (S0 state = SYN sent, no SYN-ACK), DNS leak detection
- Found DNS traffic bypassing VLAN isolation via a NAT redirect rule left from a previous config; fixed by explicit block on port 53
- Detected IoT device making unexpected MQTT (port 1883) connections to unrecognised domain; isolated with host-specific block rule
- VLAN hopping test (802.1Q double-tagging via scapy): not viable in virtual environment; limitation documented
MITRE ATT&CK
T1040: Network SniffingT1018: Remote System Discovery
Tools
pfSenseZeekWiresharkscapyVirtualBoxUbuntu