HomeLab Setup with a Firewall, SIEM Solution, Exploitable machines and an Attacker.
A Homelab is an environment meant to simulate enterprise components and configuration. The goal here is to understand the process of installing, configuring, maintaining and updating this entire infrastructure. We are building a virtualized Homelab as it is beginner friendly and easier to configure and spin up.
- Attacker - Parrot Security OS
- Firewall - pfSense
- IDS - SecurityOnion
- SIEM - Splunk
- Hypervisor - VMWare/Virtualbox
- Domain Controller - Windows Active Directory
- Vulnerable Machines - Ubuntu, Windows, DVWA
We will need a Hypervisor to install all of our tools and services.
I'll be using VMWare Workstation, being a student I get a license for it for free. Although VirtualBox is also a great free alternative as a Hypervisor.
You can download VMWare Workstation at -
You can download VirtualBox at -
pfsense will act as the edge of our Homelab virtual network and will be only accessible from the Parrot Machine.
pfsense community edition can be downloaded from - pfsense community edition ISO
You can follow these steps to install & configure pfsense -
-
Open VMWare Workstation & Create a new Virtual Machine with the "Typical (recommended)" setting.
-
Browse the pfsense CE ISO file and select Next.
(You might need to extract the ISO file from your pfsense download as it is usually zipped.)
-
Change your VM name to "pfsense" & click Next.
-
Leave the disk size to 20GB and ensure split virtual disk into multiple files option is selected.
-
Click on customize hardware and increase the memory limit to 1GB.
-
Add 5 Network Adapters and correspond them with a VMnet interface as per the image by selecting Custom specific Virtual Network.
-
Select Finish. The pfsense machine will power on and you can accept all the default values, after that pfsense will boot.
-
Press Install, and select all the default configurations.
- After the pfsense is done rebooting you will reach this screen.
- Select option 1 to set up the VLAN. Follow by -
'Should VLAN's be set up now [y|n]?' - n
Enter the interfaces in respective order for each prompt -
- em0 -> WAN
- em1 -> LAN
- em2 -> Optional 1
- em3 -> Optional 2
- em4 -> Optional 3
- em5 -> Optional 4
'Do you want to proceed [y|n]?' - y
- Select option 2. We will configure the LAN Interface so select 2 again.
We will use IP Address 192.168.1.1 to access the pfsense WebGUI. Configure the LAN Interface same as below.
For, 'Do you want to revert to HTTP as the webConfigurator protocol? (y/n)' - n
- The Configuration for OPT1 Interface is -
- The Configuration for OPT2 Interace is -
-
The OPT3 Interface should be left without an IP as it is going to have the span port with traffic that the IDS (Security Onion) is going to be monitoring.
-
The Configuration for OPT3 Interface is -
- With this we have configured the pfsense VM. Rest of the configuration will be done using the Parrot Machine through the WebConfigurator.
Security Onion is an open-source IDS, Security Monitoring and Log Management solution.
You can download Security Onion from -
Follow these steps to install and configure Security Onion for our network -
-
Open VMWare Workstation and select Typical Installation -> Next
-
Click on installer disc image file and browse & select the Security Onion ISO file -> Next
- Choose Linux in Guest Operating System and CentOS 7 64-bit -> Next
-
Put in SecurityOnion as the VM name -> Next
-
Specify disk size (minimum 200GB) make sure to store it as a single file -> Next
- Click 'Customize Hardware' -> Increase Processor to 2 -> Change memory to 4-32GB (I recommend atleast 8 GB)-> Add 2 Network Adapters and assign them Vmnet4 & Vmnet5
-
Click Finish and Bootup the 'SecurityOnion' VM -> Click Enter on the 'Installing Security Onion in basic graphic mode'
-
After loading, enter 'yes' when you get this prompt.
- Set a username and password for the administrator account -> After Security Onion reboots enter those credentials -> Select Yes
-
Select 'Run the standard Security Onion installation'
-
Select the EVAL option
-
Type 'Agree'
-
Select a hostname, I kept the default
-
Use spacebar to select ens33 as the management interface -> Press Enter
-
Select DHCP to set up the the management interface
-
Select 'YES' -> Select 'OK' -> Select 'Standard' for how this manager should be installed.
-
Select 'Direct' -> After preflight checks, select ens35 as the Monitor Interface
-
Select 'Automatic' for the OS patch schedule -> Accept all default values for Home Network CIDR ranges, Docker IP Range,
-
Enter Email Address and password for your Email account for Admin account
-
Select 'IP' for access to web interface -> Select 'Yes' for NTP server and accept defaults.
-
Enter '192.168.3.10' when asked for an IP address to access Web Interface
- Take a screenshot of the final settings, Especially the Web Access IP Address
- You will get this prompt at the end of installation of Security Onion.
-
Next we will access the Security Onion Interface from our VLAN Network which normally the SOC will do. Any machine like Ubuntu or any other flavour in the network will work and you can set it up on your own. I am using Kali as I have it already installed.
-
After the VM is installed you can get the IP Address of the machine and add it to the Security Onion instance by running the command
sudo so-allow
Enter your password -> Type 'a' and wait for the process to complete.
This will create a firewall rule on Security Onion for the Kali Linux machine that will allow you access to the Web Interface.
- Go to the Security Onion web interface address on the Kali Machine. You can login in it using the Email ID and Password you provided during the setup.
- Your Security Onion is configured.
I have used Kali Machines extensively before, but I wanted to try out Parrot OS that is why I will be using a Parrot OS as an attack machine to perform offensive attacks against the Domain Controller (Windows Active Directory) and other machines on the virtual network. You can use the Kali Machine if you like.
Parrot OS Installation Guide on VMWare
After installing the Parrot OS iso as a new VM in VMWare Workstation, before booting it change the Network Adapter to Vmnet2 and its Memory to 4GB.
Power on the machine using the credentials during the setup.
The Parrot OS Machine is ready to use.
