Attack-and-Defend Lab: pfSense or OPNsense Firewall Plus Vulnerable Targets

Part of our free Build Your Own Cyber Lab series. Work through it in order, or jump to the part you need.

1. Plan your lab: hardware, hypervisors and safe networking
2. VirtualBox and VMware basics, then Kali, Parrot and Windows 11
3. Beyond VirtualBox: Hyper-V, VMware Workstation and Proxmox
4. Dual boot Kali Linux and Windows safely
5. Ubuntu in your lab: desktop, server, SSH and Docker
6. Active Directory lab with Windows Server
7. Attack-and-defend network: firewall and vulnerable targets (you are here)
8. Metasploitable 2 and 3: install and first exploits
9. Blue-team lab: Wazuh, Sysmon and Security Onion
10. Android app testing lab: emulator, MobSF, Frida and Burp
11. OT/ICS security lab: OpenPLC, Modbus and an HMI
12. Network lab: build it in Packet Tracer or GNS3, read it in Wireshark

Why add a firewall VM

So far each lab network has been either fully isolated or fully open. A firewall VM gives you the middle ground real networks have: segments that can talk only where you allow it, a controlled path to the internet for updates, and logs of every connection - which is exactly what you need to practise both attacking and defending.

The target layout

Step 1: Build the firewall VM

pfSense CE and OPNsense are both free, FreeBSD-based firewalls with web interfaces. Pick either; the steps are nearly identical.

1. Create a VM with 1-2 GB RAM, 1 CPU, a 16 GB disk and three network adapters: Adapter 1 on NAT (WAN), Adapter 2 on the CORP isolated network, Adapter 3 on the ATTACK isolated network.
2. Install from the ISO with default options.
3. At the console menu, assign interfaces: WAN to the first adapter, LAN to CORP, and OPT1 to ATTACK. Set LAN to 10.20.0.1/24 and enable its DHCP server if you like.
4. From WS01 (on CORP) browse to https://10.20.0.1 and finish the setup wizard. Change the default admin password first.
5. Enable OPT1, give it 10.30.0.1/24, and rename it ATTACK.

Step 2: Write the rules

Firewall rules are evaluated per interface, top to bottom, first match wins.

• ATTACK interface: allow ATTACK net to ATTACK net; block ATTACK net to any other destination. Vulnerable machines must not reach CORP or the internet.
• CORP interface: allow CORP to the internet (for Windows Update), and block CORP to ATTACK unless an exercise needs it.
• Exercise rules: when you want Kali to attack the domain, add a specific rule (Kali's IP to DC01's IP), then disable it afterwards.

Turn on logging for block rules and watch Status > System Logs > Firewall while you scan from Kali - seeing your own nmap scan get blocked teaches more than any diagram.

Step 3: Add vulnerable targets

Put every target on ATTACK only.

• Metasploitable 2 and 3: Rapid7's intentionally vulnerable Linux and Windows VMs. Part 8 walks through installing both. Never put them on a bridged or NAT network.
• DVWA (Damn Vulnerable Web Application): a PHP/MySQL app with adjustable difficulty for SQL injection, XSS, command injection and file upload practice.
• OWASP Juice Shop: a modern, intentionally insecure web shop with a scoreboard of challenges covering the OWASP Top 10.
• VulnHub machines: hundreds of community-made vulnerable VMs. Read the description for the intended network setup and difficulty.

The easiest way to run DVWA and Juice Shop is Docker on a small Linux VM on the ATTACK network (temporarily give it internet via a rule while pulling images):

sudo apt install -y docker.io
sudo docker run -d -p 3000:3000 bkimminich/juice-shop

Then browse to http://<vm-ip>:3000 from Kali. DVWA's own README describes its current Docker setup.

Step 4: Practise both sides

1. Recon from Kali: nmap -sV 10.30.0.0/24 to find the targets.
2. Exploit a known-vulnerable web app such as DVWA, or work through Juice Shop's scoreboard.
3. Defend: read the firewall logs, then add the rule that would have stopped the scan or the exploit, and confirm it works.

Our Haxplain lessons cover SQL injection, XSS, command injection and more, each with the detection and fix - perfect companions to DVWA and Juice Shop.

Keep it legal and contained

Only attack machines you own or have written permission to test. Vulnerable VMs and malware samples belong on an isolated network with no route to your home LAN or the internet, and never expose a deliberately vulnerable machine with a bridged adapter or a port forward.

Next step

Part 8 installs Metasploitable 2 and 3 and walks through your first exploits against them.