Project Overview

This project focuses on designing, configuring, and securing a demilitarized zone (DMZ) using pfSense firewall and Snort intrusion detection and prevention system (IDPS). The simulation involves a full cycle of vulnerability analysis, firewall rule tuning, and IDPS deployment within a segmented network.

The project reflects real-world security operations practices, particularly how overly permissive firewall rules can be exploited, and how security devices like Snort can be strategically placed and configured to mitigate such threats.

Objectives

• Understand and demonstrate the role of firewalls within a network security architecture.
• Identify and correct insecure firewall configurations that allow unwanted traffic.
• Configure Snort as a Network Intrusion Detection System (NIDS) on a DMZ interface.
• Monitor, detect, and respond to suspicious traffic using Snort.
• Evaluate the effectiveness of updated firewall and intrusion detection configurations using Kali Linux, Nmap, and Netcat.

Network Topology

The virtual environment consists of the following machines:

• vWorkstation: Analyst workstation for SSH, browser access, and Nmap scans.
• WebServer01: A public-facing web server inside the DMZ.
• WebServer02: Main web server.
• pfSense: Acts as the central firewall and IDPS platform.
• Kali: Used as the attacker and testing machine.