Exercise 2 – Setting up and a configuring a pfSense firewall

Even though a firewall is arguably not a passive security monitoring tool, the logs and events it generates do give us a passive view on what traverses the firewall (and hence traverses security boundaries). Firewall logs can give us detailed information on what is allowed or blocked at the network segment edges, and these should be included in a holistic security monitoring approach.

In this section, we will go over the ins and outs of deploying a software-based firewall—pfSense—and see how to configure it to start sending events such as blocked and allowed connections and other interesting information to a syslog (or SIEM) server.

I chose the pfSense software-based firewall because it is the most versatile, stable, expandable, and configurable firewall putting no money down will buy you. A pfSense VM is a convenient way to add a firewall, routing, network address translation (NAT), and event DPI...