Secure Edge Networking (pfSense)
A comprehensive branch-office firewall setup. This architecture utilizes pfSense to manage strict VLAN boundaries, deploy Wireguard IPsec tunnels for remote workers, and block malicious traffic dynamically with Suricata.
1. VLAN Segmentation
Rationale: Rather than dumping all corporate devices onto a flat network, we segment the office into Corporate, Guest, and IoT VLANs. Devices like Smart TVs and security cameras (IoT) are completely isolated from the Corporate subnet, neutralizing lateral movement if an IoT device is compromised.
# Pseudo-rule translation for pfSense Firewall
# Rule 1: Allow Corporate (VLAN 10) to reach internet
PASS IPv4 * VLAN10_NET * * * *
# Rule 2: Block IoT (VLAN 20) from reaching Corporate (VLAN 10)
BLOCK IPv4 * VLAN20_NET * VLAN10_NET * *
# Rule 3: Allow IoT to reach only specific external NTP servers
PASS IPv4 UDP VLAN20_NET * 8.8.8.8 1232. Wireguard Tunnels
Rationale: We replace legacy OpenVPN deployments with Wireguard due to its significantly reduced cryptographic overhead and near-instant connection times. Remote workers are securely tunneled directly into the Corporate VLAN.
[Interface]
PrivateKey = <CLIENT_PRIVATE_KEY>
Address = 10.200.0.2/32
DNS = 10.200.0.1
[Peer]
PublicKey = <PFSENSE_PUBLIC_KEY>
Endpoint = vpn.yourdomain.com:51820
AllowedIPs = 10.200.0.0/24, 192.168.10.0/24 # Route only corporate traffic through VPN
PersistentKeepalive = 253. Suricata IDS/IPS
Rationale: Working as an Inline Intrusion Prevention System (IPS), Suricata actively drops packets matching known malware signatures or emerging threats lists (like the ET Open Ruleset) before they ever hit the internal routing table.
# Example Custom Drop Rule
drop tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"SSH Brute Force Blocked"; flow:established,to_server; content:"SSH-2.0-OpenSSH"; threshold:type limit, track by_src, count 5, seconds 60; sid:100001; rev:1;)