Case Study

pfSense Network Segmentation.

A lab architecture case study for VLAN separation, firewall boundary intent, DNS/DHCP placement, VPN access review, and validation planning without claiming completed live migration.

Back to ProjectsOpen Proof Library
pfSense network segmentation architecture diagram

Executive Summary

Segmentation planning documented for operational review.

This case study explains a pfSense-oriented segmentation model for separating WAN, management, workstation, server, lab/test, and VPN access zones. The evidence is methodology and architecture documentation, not a claim that every firewall rule has been validated on live systems.

Business Objective

Reduce support ambiguity through clear network boundaries.

Document where traffic should flow, where management access should be restricted, and what validation evidence is required before broader lab migration.

Skills Demonstrated
  • pfSense firewall and routing concepts
  • VLAN design and default-deny policy intent
  • DNS/DHCP placement review
  • VPN boundary planning
  • Network validation and rollback thinking

Technical Environment

Home lab network planning context.

The documented lab context includes a 192.168.0.0/24 base network, Dell R710 lab workloads, a D-Link switch, Proxmox, Active Directory-style services, DNS, DHCP, VPN access, and pfSense as the firewall and routing control point.

Architecture Overview

Zone-based firewall and service placement model.

The architecture separates internet edge, management, workstation, server, lab/test, and VPN paths. The design emphasizes restricted management access, documented service flows, logged troubleshooting windows, and policy review before expanding remote access.

Implementation Approach

Document policy intent before live rule claims.

The implementation plan records zone purpose, typical systems, default-deny assumptions, allowed service requirements, DNS/DHCP dependencies, VPN route review, and evidence still required from pfSense or switch exports.

Validation Process

Confirm gateway, VLAN, DNS, DHCP, firewall, and VPN behavior with documented checks before presenting the design as implemented. Keep checklist results separate from planned methodology.

Lessons Learned

Network evidence is most credible when design intent, service dependencies, firewall policy, and required validation artifacts are separated from unverified completion claims.

Related Evidence

Open the source artifacts.

Segmentation write-up

Architecture documentation for pfSense segmentation goals and evidence boundaries.

Open Evidence

Segmentation diagram

Visual map for firewall zones and network boundaries.

Open Diagram

VLAN walkthrough

Operational walkthrough for VLAN strategy and Proxmox bridge review.

Open Walkthrough

Network validation checklist

Methodology for recording gateway, VLAN, DNS, DHCP, VPN, and firewall test evidence.

Open Checklist