What Week 2 covers

Last week we ended with a working hypervisor and an empty network. This week we give it segments, routing rules, and three virtual machines that talk to each other on purpose — plus one extra-credit firewall appliance.

Acronym key (we will use these a lot)

Quick reference now so the rest of the deck reads clean. A fuller glossary lives on the last slide.

Two topologies — required vs. extra credit

Same hardware, two paths through it. The instructor's plan keeps routing on the host. The extra-credit pfSense build moves perimeter duty into a dedicated firewall appliance.

Both paths give the same end result: three segmented zones, NAT to the school network, one entry point for SSH. The difference is where the routing logic lives — and how realistic it looks.

Step 1 · Three virtual bridges

A vmbr (virtual machine bridge) is a software switch inside Proxmox. Each VM is plugged into one. We need three.

Edit /etc/network/interfaces and reload with ifreload -a.

# vmbr0 — management, bridges to the physical NIC eno1
auto vmbr0
iface vmbr0 inet static
    address  10.10.10.10/16
    gateway  10.10.10.1
    bridge-ports eno1
    bridge-stp off
    bridge-fd  0

# vmbr1 — DMZ, no physical port (internal only)
auto vmbr1
iface vmbr1 inet static
    address  172.16.0.10/24
    bridge-ports none

# vmbr2 — LAN, no physical port
auto vmbr2
iface vmbr2 inet static
    address  192.168.0.10/24
    bridge-ports none

Step 2 · Turn on IP forwarding

By default Linux refuses to pass packets between interfaces. Routers route. To turn the Proxmox host into a router, we flip one switch.

# Right now (until next reboot)
sudo sysctl -w net.ipv4.ip_forward=1

# Permanently — uncomment this line in /etc/sysctl.conf
net.ipv4.ip_forward=1

# Verify
cat /proc/sys/net/ipv4/ip_forward
# expected output: 1

Step 3 · Outbound NAT (MASQUERADE)

NAT (Network Address Translation) rewrites IP addresses on packets as they cross the router. MASQUERADE is a flavor of source NAT that uses whatever address vmbr0 currently has — convenient because we don't have to hard-code 10.10.10.10.

# Add the rules
sudo iptables -t nat -A POSTROUTING -s 172.16.0.0/24  -o vmbr0 -j MASQUERADE
sudo iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o vmbr0 -j MASQUERADE

# Persist them across reboots
sudo apt install iptables-persistent
sudo netfilter-persistent save

Step 4 · Inbound port forward (DNAT)

DNAT (Destination Network Address Translation) rewrites where a packet is going. We use it to expose a single internal service — SSH on the Jump Box — to the school network.

# Anything hitting the host on TCP 2222 → forward to the Jump Box's SSH
sudo iptables -t nat -A PREROUTING -i vmbr0 -p tcp --dport 2222 \
   -j DNAT --to-destination 172.16.0.5:2222

# And explicitly allow the forwarded traffic
sudo iptables -A FORWARD -p tcp -d 172.16.0.5 --dport 2222 -j ACCEPT

sudo netfilter-persistent save

From your laptop on the school network: ssh -p 2222 [email protected] reaches the Jump Box. The Jump Box never has a public address, and only port 2222 is exposed.

Step 5 · Upload three installer images

An ISO is a single-file image of an installer disk. Proxmox stores them in the local storage and attaches them as virtual CD/DVD drives.

Proxmox web UI → local (tctmachine) → ISO Images → Upload. Verify SHA-256 checksums after upload.

The virtual machines at a glance

pfSense — extra credit deliverable

pfSense is a free, open-source firewall and router built on FreeBSD. The name means roughly "packet filter sense" — packet filter is the underlying engine. We're standing it up as the extra-credit perimeter device.

pfSense — VM specs and first boot

Built as VM 100 on the Proxmox node tctmachine, running pfSense 2.8.1-RELEASE (amd64) on the Netgate installer.

WAN interface name:   vtnet0
LAN interface name:   vtnet1
Optional 1:           vtnet2

Then option 2 — Set IP addresses:

WAN  : 10.10.110.10/16
       gw 10.10.10.1
LAN  : 172.16.0.20/24
       (serves the DMZ)
OPT1 : 192.168.0.1/24
       (serves the private LAN)
       DHCP .100 – .200

pfSense — live console (proof of build)

Captured 2026-05-01 from the Proxmox Console tab on VM 100. Three interfaces assigned, three IP addresses set, web admin reachable from the host.

pfSense — web UI dashboard (proof of build)

Logged into the pfSense web administrator from the Proxmox host. Status / Dashboard reports a healthy system, version current, both interfaces link-up, and resources well within VM allocation.

pfSense — the one gotcha to remember

Out of the box, pfSense's WAN interface drops anything from RFC1918 private addresses. In a normal home network that's correct. In a lab where the WAN is a private subnet, it silently kills every packet.

In the web wizard (or later under Interfaces → WAN):

• Uncheck "Block private networks and loopback addresses"
• Uncheck "Block bogon networks"

Jump Box — short recap

Covered in depth in last week's deck. The shortest version, for anyone joining cold:

Windows Server 2022 — the DNS authority

DNS (Domain Name System) turns names like linuxsrv.capstone.local into IP addresses. Inside the lab, every VM points to this Windows Server first.

Linux Server — general workload

Same Ubuntu install as the Jump Box, but it lives on the LAN and isn't hardened down. It's the “normal” server — anything we'd put behind the firewall in a real environment.

After install: sudo apt update && sudo apt upgrade, set hostname to linuxsrv, install net-tools, nmap, and the SSH server.

Reverse routes — the easy thing to forget

A LAN VM's gateway is pfSense. pfSense doesn't know about the DMZ, only the host does. So we tell each LAN VM "for anything in 172.16.0.0/24, ignore the default gateway and use the host directly."

sudo ip route add 172.16.0.0/24 via 192.168.0.1

routes:
  - to: 172.16.0.0/24
    via: 192.168.0.1

route -p add 172.16.0.0 ^
  mask 255.255.255.0 ^
  192.168.0.1

Pf Sense becomes the doorway — but the doorway also has to know which other rooms exist.

Verification — the demo runbook

Five tests in five minutes. Each one proves a specific layer is doing its job.

1. Bridges are up — Proxmox UI shows vmbr0, vmbr1, vmbr2 all Active = Yes, Autostart = Yes.
2. Forwarding + NAT — from the Linux Server: ping 1.1.1.1 succeeds. (Tests the host's MASQUERADE.)
3. DNS — from the Linux Server: nslookup linuxsrv.capstone.local 192.168.0.2 returns 192.168.0.3.
4. pfSense web UI — from the Linux Server: https://192.168.0.1 loads.
5. Inbound DNAT — from a separate laptop on the school network: ssh -p 2222 [email protected] lands on the Jump Box.

Where Week 2 leaves us

Acronyms — full glossary