Brief:
pfSense DMZ setup has two parts: NAT Port Forward (Firewall → NAT → Port Forward), which routes WAN traffic to the DMZ server, and Firewall Rules (Firewall → Rules → DMZ tab), which block DMZ from reaching LAN/Guest — these block rules must sit at the top so that if the DMZ is compromised, the attacker can't pivot into the LAN. That's the core logic
- Project Name:
- pfSense-Segmented-Office
- Description:
-
Segmented office network topology on pfSense — WAN, LAN, DMZ, and Guest WiFi zones with VLAN isolation
- Key Configuration:
- DHCP enabled Guest DNS pointed to public resolvers, NAT port forwarding WAN to DMZ, filter rules auto-created, firewall block rules for DMZ/Guest, aliases like LAN_NET, GUEST_NET, and RFC1918, DMZ isolated by blocking DMZ to LAN, Guest isolated by blocking Guest to LAN and Guest to DMZ, HAProxy
