This project, carried out as part of my academic training, aims to deploy a secure network infrastructure using pfSense. The objective is to implement a defense-in-depth strategy (segmentation, firewall, proxy, IDS/IPS, VPN) to protect an enterprise network.
- 3-Zone Segmentation : WAN (external), LAN (internal), DMZ (exposed servers).
- Firewall : "Deny by default" policy with restrictive rules (notably DMZ → LAN).
- Proxy & Filtering : Squid in transparent mode, coupled with SquidGuard for category-based blocking (University of Toulouse blacklist).
- Intrusion Detection : Snort in IPS mode with a "Balanced" policy (effective detection of Nmap scans).
- VPN : OpenVPN for remote access (certificate + password) and Site-to-Site.
- Internal PKI : Creation of a Certificate Authority (CA) to secure the Web interface, SSL interception, and VPN tunnels.
- [
docs/Projet_Securisation_pfSense.pdf](docs/Projet de sécurisation réseau avec pfSense.pdf) : Complete PDF report, containing all installation steps, screenshots, and technical justifications. LICENSE: Project license (MIT).
- Comprehensive Approach : Covers the majority of security building blocks for an enterprise network.
- Documented Error Handling : The report shows the issues encountered (notably regarding HTTPS interception) and the solutions implemented, demonstrating strong analytical skills.
- Cryptographic Consistency : Use of the same PKI infrastructure across multiple services.
- VMware Workstation / VirtualBox
- 2 pfSense virtual machines (or 1 pfSense + 1 Windows/Linux client)
- Basic networking knowledge (subnets, routing)
- Download the PDF file from the
docs/folder. - Follow the chapters in order: from the initial installation to the VPN setup.
- The screenshots illustrate each key step.
Salma Ouchahed
This project is licensed under the MIT License - see the LICENSE file for details.