Every step is one page: what to do, the exact commands to copy, what you should see, and what it means. Work through them in order; each one builds on the last.
You need: a Windows 10 or 11 PC with 8 GB of memory. No network gear, no cloud account. Commands are typed in Windows Terminal or PowerShell, not PowerShell ISE.
| Step | What you'll do | Time |
|---|---|---|
| 0 | Set up your PC Docker running on Windows, the lab downloaded into its own folder, and started for the first time. | 30 min, once |
| 1 | Prove the path Prove every packet between the LAN and the DMZ goes through the firewall, and only the firewall. | 5 min |
| 2 | Find your way around See what's running, step inside a machine, and start, stop or reset the lab. | 10 min |
| 3 | Watch the traffic: two views See the same traffic two ways: the firewall's log and a packet capture. | 10 min |
| 4 | Services on the wire Sign in to the server three ways, web, Telnet and SSH, and see which passwords can be read off the wire. | 15 min |
| 5 | One password, three doors Use the password read off the wire to walk through the one door that was encrypted, and see what the logs make of it. | 10 min |
| 6 | Lock it down Switch the firewall from allow-everything to deny-everything, watch it all break, and read the drops in the log. | 10 min |
| 7 | Open for purpose Open only what each task needs: web for everyone, SSH for client-a only, Telnet for no one. Then see why rule order matters. | 15 min |
| 8 | The way around Give traffic a second path that skips the firewall, and learn the three signs that give it away. | 10 min |
| 9 | Host firewalls Find which firewall is blocking: fw, the server's own, or the client's own. Two planted faults, one method. | 15 min |
| 10 | Check your work, and save it as code Prove Phase 1's policy is in place, save the rules to a file, compare them with the answer key, and load them back. | 10 min |
| next | Phase 2: Legacy Port Knocking Test |