🔥 pfSense Firewall + Suricata IPS Lab

An enterprise-grade network security lab deploying pfSense as a perimeter firewall with Suricata running in active Intrusion Prevention System (IPS) mode — upgrading from detection-only to real-time attack blocking.

Lab 2 of the SOC Home Lab series — builds on the NSM Lab (Lab 1)

---

🧪 Lab Architecture

┌─────────────────────────────────────────────────────────┐
│                    VirtualBox Environment               │
│                                                         │
│   Internet                                              │
│      │                                                  │
│      ▼                                                  │
│  ┌─────────────────────────────┐                        │
│  │        pfSense Firewall     │                        │
│  │  WAN: NAT (Internet)        │                        │
│  │  LAN: Host-Only (.254 GW)   │                        │
│  │                             │                        │
│  │  ┌─────────────────────┐    │                        │
│  │  │ pfBlockerNG         │    │ ← Geo-blocking         │
│  │  │ Malicious IP Alias  │    │ ← Known bad IPs        │
│  │  │ Suricata IPS        │    │ ← Inline packet drop   │
│  │  └─────────────────────┘    │                        │
│  └──────────────┬──────────────┘                        │
│                 │ Secure LAN (192.168.x.0/24)           │
│    ┌────────────┼────────────┐                          │
│    ▼            ▼            ▼                          │
│ Ubuntu       Ubuntu       Windows 10                    │
│ Server       Desktop      (Endpoint)                    │
│ (Monitor)    (Attacker)                                 │
└─────────────────────────────────────────────────────────┘

All VM traffic is routed strictly through pfSense — no direct internet access from endpoints.

---

🔧 Tools & Stack

Tool	Purpose
pfSense CE	Perimeter firewall & network gateway
pfBlockerNG-devel	Geo-blocking & malicious IP blocking
MaxMind GeoLite2	Geographic IP database
Suricata IPS	Inline intrusion prevention (60,000+ signatures)
VirtualBox	Virtualization platform

---

🛠️ Lab Setup

1. pfSense VM Configuration

Setting	Value
OS	FreeBSD (pfSense CE ISO)
CPU	2 cores
RAM	2 GB
Storage	20 GB
Adapter 1 (WAN)	NAT
Adapter 2 (LAN)	Host-Only Network

2. Initial pfSense Web GUI Setup

• DNS servers updated to Google (8.8.8.8)
• Admin credentials locked down
• Custom domain assigned: cdm.local

---

🌍 Firewall Intelligence & Geo-Blocking

Malicious IP Aliasing

A custom firewall alias (malicious_IPs) groups known bad IP addresses into a single entry — blocking entire threat groups at the WAN layer with one rule.

Geo-Blocking with pfBlockerNG

1. Install pfBlockerNG-devel package inside pfSense
2. Register for a free MaxMind GeoLite2 account
3. Sync geographic IP ranges into pfSense
4. Create WAN rules to drop all traffic from high-risk regions automatically

---

🚨 Suricata in Inline IPS Mode

Key Difference: IDS vs IPS

Mode	Action
IDS (Lab 1)	Detects and alerts — traffic still passes
IPS (Lab 2)	Detects and drops — traffic blocked in real time

Configuration Steps

1. Install Suricata on pfSense
2. Enable Block Offenders option
3. Set mode to Inline Mode
4. Load threat intelligence rulesets:
   • Malware signatures
   • System scan detection
   • Exploit behavior patterns

---

🔒 Network Hardening

Isolating Endpoints

• Disabled direct NAT adapters on all lab VMs (Ubuntu Server, Ubuntu Desktop, Windows 10)
• All internet traffic now forced through pfSense gateway

Gateway Reconfiguration

Linux (Ubuntu) — Netplan:

network:
  version: 2
  ethernets:
    enp0s3:
      dhcp4: no
      gateway4: 192.168.x.254   # pfSense LAN IP
      nameservers:
        addresses: [8.8.8.8]

Windows 10:

• Network Adapter → IPv4 Properties
• Default Gateway: 192.168.x.254 (pfSense LAN IP)

---

✅ Validation Test

Test: Triggering & Blocking with testmynids.org

From Ubuntu Desktop, run:

curl http://testmynids.org/uid/index.html

Result 1 — Alert mode: Traffic flagged but allowed through Result 2 — After switching rule to Drop: Connection times out — packet blocked at perimeter

pfSense dashboard logs confirm the packet was dropped at the WAN layer before reaching any endpoint.

---

📁 Repository Structure

pfsense-ips-lab/
├── README.md               # This file
├── docs/
│   └── setup-notes.md      # Detailed configuration notes
├── rules/
│   └── custom-notes.md     # Suricata rule modifications used
└── screenshots/
    └── .gitkeep            # Evidence screenshots 

---

🎯 Skills Demonstrated

• pfSense firewall deployment and configuration from scratch
• Dual-interface WAN/LAN network segmentation
• Geo-blocking implementation with pfBlockerNG + MaxMind GeoLite2
• Custom firewall alias creation for threat group blocking
• Suricata upgrade from passive IDS → active IPS inline mode
• Endpoint network isolation and gateway rerouting
• IPS validation using testmynids.org
• Real-time packet drop verification via pfSense dashboard logs

---

📌 References

• pfSense Documentation
• pfBlockerNG Guide
• Suricata IPS Mode
• MaxMind GeoLite2
• Lab 1 — NSM Lab

---

🔗 SOC Home Lab Series

Lab	Project	Status
Lab 1	NSM Stack — TShark + Zeek + Suricata IDS	✅ Complete
Lab 2	pfSense Firewall + Suricata IPS (this repo)	✅ Complete