What this is
A complete little network you run on your own PC: a firewall between a LAN and a DMZ, two client machines and a server, all in Docker. You build it, attack it, fix it, and measure it, with one firewall at the centre of everything.
It’s built for two readers. An employer can see how I design, secure and explain a network, end to end. Anyone learning can run the very same lab and follow along, because it’s all here: the machines, the firewall rules, the written guide, and the commands to copy.
LAN 10.10.10.0/24 DMZ 10.10.20.0/24
client-a .11 authorized user ──┐ ┌── server .10
├── fw ────┤ web · ssh
client-b .12 outsider ──┘ .1 .1 └── telnet · rdp
Every packet between the LAN and the DMZ crosses fw. Nothing reaches the internet.
Everything that crosses the firewall is logged and captured, so every lesson ends in the packets, not in a claim.
What to expect
The lab is built in five phases. Each one takes a single real problem, shows it on the wire, then changes something and shows the result the same way. A phase is a set of short pages: what to do, the exact commands to copy, what you should see, and what it means.
You need a Windows 10 or 11 PC with Docker Desktop and 8 GB of memory. No networking gear, no cloud account. One command brings the whole lab up, and Phase 1, step 0 sets up Docker from scratch.
One honest note up front: the port knock built in Phase 2 is one layer on a deny-all firewall, not a lock on its own. The lab shows plainly where it falls short and what replaced it. Nothing here is presented as more than it is.
Open a phase below to see its steps, or start at Phase 1.
The phases
Stand the network up and watch it in the open: read logins off the wire, lock the firewall down rule by rule, then find the one way around it.
Hide SSH and RDP behind a port knock so they vanish from the network, send the secret to open them, then see why a knock anyone can copy eventually breaks.
Close every weakness from Phase 1 by hand: drop Telnet, move the web login to HTTPS, switch SSH to keys, then prove each leak is shut.
Put the knock next to Single Packet Authorization under the same replay test, and watch the modern one hold where the knock gave way. WireGuard is covered as a read.
Shape the link on the firewall and measure what the clients feel: cap the bandwidth, add delay and jitter, then drop packets on purpose.
The pieces
Each project is laid out in the same order: the problem that started it, the documents that plan it, what was built, and the proof that it works. Open any card to read it.
How it connects
The projects build on each other, in order. Each one starts from what the one before it produced.