Part 1: Network Configuration using pfSense
In the previous article, I introduced the overall architecture of the Cybersecurity and Malware Analysis Lab, including the objectives, system requirements, network design, and centralized logging strategy. With the virtual machines already deployed, the next step is establishing the network infrastructure that will allow the systems to communicate securely while maintaining proper segmentation between the Cybersecurity Lab and the Malware Analysis Lab.
At the center of this architecture is pfSense, an open-source firewall and routing platform that provides network security, traffic management, and internet connectivity. In addition to acting as the default gateway for all virtual machines, pfSense is responsible for network segmentation, DHCP services, DNS forwarding, and traffic control between internal networks and external resources.
The Cybersecurity Lab and Malware Analysis Lab are designed as separate environments, each with its own subnet and dedicated pfSense deployment. This separation ensures that malware analysis activities remain isolated from the enterprise simulation environment while still allowing controlled access to the internet when required.
The Cybersecurity Lab consists of Windows Server 2022, Windows 11, Kali Linux, and Metasploitable. The Malware Analysis Lab consists of REMnux and Windows 10,running on FLARE-VM. Logs generated by systems within these environments are forwarded to Splunk Enterprise running on the host machine, enabling centralized monitoring, threat detection, and security analysis.
Configuring WAN Connectivity
The first step in configuring pfSense is establishing internet connectivity through the WAN interface. Since the lab environment is hosted in VirtualBox, the WAN interface is connected to a NAT network, allowing internal systems to access external resources while remaining isolated from the physical network.
Step 1: Verify VirtualBox Network Adapters
pfSense VM
Open:
VirtualBox → pfSense → Settings → Network
Configure:
Adapter
Type
Network Name
Adapter 1
NAT
Default
Adapter 2
Internal Network
CYBER_LAB
Adapter 3
Internal Network
MALWARE_LAB
Adapter 4
Host-Only Adapter
VirtualBox Host-Only Ethernet Adapter
Step 2: Identify pfSense Interfaces
Once pfSense boots, the system detects available interfaces and allows manual assignment. Each interface is mapped to a specific role within the architecture.
On the pfSense console:
1) Assign Interfaces
You should see something similar:
em0 = NAT
em1 = CYBER_LAB
em2 = MALWARE_LAB
em3 = HOST_ONLY
Confirm:
WAN = em0
LAN = em1
OPT1 = em2
OPT2 = em3
Get Joseph Ngahu’s stories in your inbox
Join Medium for free to get updates from this writer.
The WAN interface is assigned to the NAT-connected adapter. One internal interface is assigned to the Cybersecurity Lab network, another to the Malware Analysis Lab network, and the final interface is reserved for host-only communication.
This mapping creates a clear separation between environments at the network level, ensuring that each segment operates independently under controlled routing rules.
WAN Configuration
After assigning interfaces, the next step is configuring the WAN interface.
Navigate to:
Interfaces → WAN
Configure the following settings:
Setting
Value
Enable Interface
Enabled
IPv4 Configuration Type
DHCP
IPv6 Configuration Type
None
Block Private Networks
Disabled
Block Bogon Networks
Disabled
The WAN interface is enabled and configured to obtain an IP address dynamically using DHCP from the VirtualBox NAT network. IPv6 is disabled since it is not required for this lab environment.
Private and bogon network blocking is disabled to ensure proper connectivity within the virtualized NAT setup. After saving and applying the configuration, pfSense should automatically obtain an IP address from the VirtualBox NAT network.
Verifying WAN Connectivity
After configuration, it is important to confirm that pfSense has external connectivity.
Navigate to:
Status → Interfaces
The WAN interface should display an address similar to:
WAN IP Address: 10.0.2.15
Gateway: 10.0.2.2
From the pfSense console, connectivity can be tested by pinging a public IP address such as 8.8.8.8. A successful response confirms that the firewall can reach external networks through the NAT gateway.
To verify connectivity, navigate to:
Select option 7 in the menu
Enter IP Address:
8.8.8.8
A successful response confirms that pfSense can communicate with external networks.
The next validation step is DNS resolution. By pinging a domain such as google.com, it becomes possible to verify that name resolution is functioning correctly in addition to raw network connectivity.
To verify DNS resolution, test by pinging google.com:
google.com
When both IP-based and domain-based pings succeed, it confirms that the WAN configuration is fully operational.
At this stage, the foundation of the lab network is in place. pfSense is now actively routing traffic, enforcing segmentation, and providing controlled internet access to all virtual environments. More importantly, the architecture now reflects a real-world security principle: separation of environments with centralized visibility. The Cybersecurity Lab and Malware Analysis Lab remain isolated at the network level, while still contributing telemetry to a unified Splunk instance. This network layer becomes the backbone for everything that follows. With segmentation and routing in place, the next phase will focus on internal network configuration, traffic flow control, and preparing the environment for realistic attack and defense simulations.
