Network security infrastructure

Prerequisites & Planning

Before You Begin: Ensure you have VMware vSphere/ESXi access, sufficient resources (2GB RAM, 2 vCPUs minimum for pfSense), and a clear understanding of your network topology.
  • Download pfSense ISO: Get the latest community edition from pfsense.org
  • Plan IP addressing: Define WAN, LAN, and DMZ subnets
  • Document current network: Map existing VM networks and requirements
  • Backup configurations: Save current VM network settings before changes

Network Architecture Overview

Internet → WAN Interface (pfSense) → LAN Interface → Protected VMs ↓ DMZ Interface → Public Services

Step-by-Step Implementation

Step 1

Create Virtual Networks in VMware

Set up isolated network segments for proper traffic segmentation:

  • Create WAN Network: Connect to your physical network/internet
  • Create LAN Network: Internal protected network (e.g., 192.168.1.0/24)
  • Create DMZ Network: For public-facing services (e.g., 10.0.1.0/24)
  • Ensure networks are isolated from each other in vSwitch configuration
Step 2

Deploy pfSense Virtual Machine

  • Create new VM: Allocate 2GB RAM, 2 vCPUs, 20GB storage minimum
  • Add network adapters: Configure 3 NICs (WAN, LAN, DMZ)
  • Mount pfSense ISO: Attach downloaded ISO to VM
  • Boot and install: Follow pfSense installation wizard
VM Configuration: - NIC 1: WAN Network (vmxnet3) - NIC 2: LAN Network (vmxnet3) - NIC 3: DMZ Network (vmxnet3)
Step 3

Initial pfSense Configuration

  • Console setup: Access VM console and run initial configuration
  • Assign interfaces: Map physical NICs to WAN/LAN/DMZ roles
  • Set IP addresses: Configure static IPs for each interface
  • Enable DHCP: Configure DHCP server for LAN segment
Example Interface Assignment: WAN: DHCP or Static Public IP LAN: 192.168.1.1/24 (DHCP: 192.168.1.100-200) DMZ: 10.0.1.1/24 (Static assignments recommended)
Step 4

Migrate VMs to Protected Networks

Important: Schedule this during a maintenance window as VMs will lose connectivity temporarily.
  • Power down VMs: Gracefully shutdown target virtual machines
  • Change network assignment: Move VM NICs from direct networks to LAN/DMZ
  • Update VM network settings: Change to DHCP or update static IPs for new subnets
  • Power on VMs: Start VMs and verify connectivity through pfSense
Step 5

Configure Firewall Rules

Access the pfSense web interface (https://192.168.1.1) and configure security rules:

  • Default LAN rules: Allow outbound, block unnecessary inbound
  • DMZ rules: Allow specific ports for public services only
  • Inter-VLAN rules: Control communication between LAN and DMZ
  • WAN rules: Block all inbound except required services
Common Rule Examples: LAN→WAN: Allow all outbound (HTTP, HTTPS, DNS, NTP) WAN→DMZ: Allow only ports 80, 443 for web servers LAN→DMZ: Allow specific management ports only DMZ→LAN: Block all (default deny)
Step 6

Enable Advanced Security Features

  • Intrusion Detection (Suricata/Snort): Install and configure IDS package
  • DNS Filtering: Enable pfBlockerNG for malware/ad blocking
  • VPN Access: Configure OpenVPN for secure remote access
  • Traffic Monitoring: Set up Ntopng for network visibility
  • Backup/Restore: Configure automatic configuration backups
Step 7

Implement Monitoring & Logging

  • Syslog configuration: Forward logs to SIEM/centralized logging
  • SNMP monitoring: Enable for network monitoring tools
  • Alert rules: Configure notifications for security events
  • Performance monitoring: Set up CPU/memory/bandwidth alerts
Syslog forwarding to Splunk/Graylog: System → Advanced → Miscellaneous Remote Syslog Server: [SIEM_IP]:514 Remote Syslog Contents: Everything
Step 8

Testing & Validation

  • Connectivity tests: Verify VM internet access and internal communication
  • Security testing: Use nmap to verify firewall rules are working
  • Performance testing: Check throughput and latency impact
  • Failover testing: Test VM behavior during pfSense maintenance
  • Documentation: Document final configuration and procedures

Post-Implementation Security Hardening

Security Best Practices: These additional steps will maximize your protection level.
  • Change default passwords: Use complex passwords for admin accounts
  • Disable unnecessary services: Turn off SSH if not needed
  • Enable two-factor authentication: Add TOTP for admin access
  • Regular updates: Schedule automatic pfSense updates
  • Certificate management: Install proper SSL certificates
  • Backup automation: Schedule regular configuration backups

Troubleshooting Common Issues

VM Connectivity Problems

  • Check VM network adapter assignments in vSphere
  • Verify DHCP scope has available addresses
  • Confirm firewall rules allow required traffic
  • Test DNS resolution and gateway connectivity

Performance Issues

  • Increase pfSense VM resources if CPU/RAM constrained
  • Enable hardware acceleration for crypto operations
  • Optimize firewall rules (specific rules before general ones)
  • Monitor network interface utilization
Emergency Access: Always maintain a management interface that bypasses pfSense for emergency access to your VMware infrastructure.