✅ Done (Week 1 + early Week 2)

• Proxmox host tctmachine · vmbr0/1/2 all UP
• pfSense2 (VM 103) routing both internal subnets · DHCP + DNS + auto-NAT
• Jumpbox (VM 101) Ubuntu 26.04 on DMZ · UFW configured · internet OK
• WinSrv (VM 102) Win Srv 2025 Eval · static 192.168.0.15 ✓
• LinuxServer (VM 105) Ubuntu 26.04 · static 192.168.0.20 · SSH up
• LAN firewall hardened (9-rule defense-in-depth) — Week 3 evidence

📋 What this deck still covers

• Phase 1 — Windows: install DNS / DHCP / IIS · create A record · publish welcome page
• Phase 2 — Linux: install NGINX · publish welcome page · install MariaDB + create DB
• Phase 3 — Cross-VM tests · ping matrix · DNS lookups · screenshots

⚠ DHCP coordination: pfSense2 currently serves DHCP for 192.168.0.0/24 (pool .100–.200). Before activating Windows DHCP, either (a) disable pfSense LAN DHCP, or (b) split the pool so the two don't overlap. Don't run two DHCP servers on the same broadcast domain.

🎯 Objective

Prove the internal network works via the NAT bridge and Jump Box, then stand up the core services both teams depend on downstream.

By Friday, any VM should be able to:

• Resolve winserver.teamx.local via your own DNS
• Lease an IP from your DHCP scope
• Browse the Windows IIS welcome page
• Browse the Linux NGINX welcome page
• Query the MariaDB capstone_db from CLI

📋 Grading watch-outs

• Every phase needs screenshots — save as you go, not at the end
• Ping results + latencies go in the table — "it works" isn't enough
• Export asset-tracker snapshot with VM names, IPs, roles
• Two reflection sentences each on: trickiest test, longest service, unresolved issues
• Cover page with week #, team, and roles

📋 Team Lead

• Coordinate the other three
• Save & log all screenshots
• Asset-tracker snapshot (VMs · IPs · roles)
• Assemble final report

🌐 Networking

• Phase 0: NAT bridge + Jump Box tests
• Phase 3: cross-VM ping & DNS lookups
• Verify DHCP leases actually issue
• Fill every ping/lookup row

🪟 Windows

• Install DNS role + zone + A record
• Install DHCP role + scope
• Install IIS + deploy welcome page
• Screenshots of each

🐧 Linux

• Install + enable NGINX
• Deploy Linux welcome page
• Install MariaDB + create DB/user
• Test query from CLI

Subnets & gateways

pfSense2 (VM 103) sits on all three bridges: WAN 10.10.110.10, DMZ .1, LAN .1. It does NAT, DHCP, and DNS resolution (Unbound + DNSSEC).

VM IP assignments — live state

⚠ Statics .2–.99 and .201–.254 are safe — outside the DHCP pool.

🛠 The 7 build steps

1. Bridges — create vmbr1 (DMZ) + vmbr2 (LAN) on the Proxmox host
2. pfSense2 — install + assign three NICs, set IPs, automatic NAT
3. DHCP + DNS — turn on pfSense's DHCP for both subnets, configure Unbound
4. LAN firewall — apply the 9-rule defense-in-depth ruleset on vmbr2
5. Jumpbox — install Ubuntu Server on vmbr1, harden SSH, enable UFW
6. WinSrv — install Win Srv 2025, set static 192.168.0.15
7. LinuxServer — install Ubuntu Server on vmbr2, set static 192.168.0.20

📸 Verification artifacts

Every step has a paired live capture from the running build (2026-05-06 verification pass). The next 7 slides walk through each step with the matching screenshot beside it.

For full step-by-step procedure with all 21 screenshots zoomable: week2-verification.html

Edit /etc/network/interfaces

# SSH or web shell to the host:
ssh root@10.10.10.10
nano /etc/network/interfaces

# add these blocks (after vmbr0):
auto vmbr1
iface vmbr1 inet static
    address 172.16.0.10
    netmask 255.255.255.0
    bridge_ports none
    bridge_stp off
    bridge_fd 0

auto vmbr2
iface vmbr2 inet static
    address 192.168.0.10
    netmask 255.255.255.0
    bridge_ports none
    bridge_stp off
    bridge_fd 0

# reload networking:
ifreload -a
ip -br addr

Both bridges are bridge_ports none — they're VM-only switches, no physical NIC backing.

VM creation (Proxmox UI)

1. Create VM → name PFsense2 (VMID 103) · 2 vCPU · 2 GB RAM · 20 GB disk
2. Add three virtio NICs:
   • net0 → vmbr0 (WAN side)
   • net1 → vmbr1 (DMZ)
   • net2 → vmbr2 (LAN)
3. Mount netgate-installer-v1.1.1-RELEASE-amd64.iso on ide2
4. Boot · run installer → all defaults · accept ZFS or UFS as preferred

Console interface assignments

After install, at the blue menu:
option 2 → Set interface(s) IP address
WAN  vtnet0 → DHCP from school LAN
DMZ  vtnet1 → 172.16.0.1/24
LAN  vtnet2 → 192.168.0.1/24

DHCP — Services → DHCP Server

1. Click DMZ tab → ✓ Enable DHCP server on DMZ
2. Pool: 172.16.0.100 – 172.16.0.200
3. DNS server pushed to clients: 172.16.0.1 (pfSense)
4. Repeat on LAN tab: 192.168.0.100 – 192.168.0.200, DNS 192.168.0.1
5. Save + Apply

DNS — Services → DNS Resolver

1. ✓ Enable DNS resolver
2. Network Interfaces: DMZ + LAN (NOT WAN)
3. Outgoing Network Interfaces: WAN
4. ✓ Enable DNSSEC Support
5. Save + Apply

NAT — Firewall → NAT → Outbound

Mode: Automatic outbound NAT — pfSense auto-MASQUERADEs both internal subnets out the WAN address.

Verified live

Fig 10 + 11 · DMZ + LAN scopes (172.16/24 and 192.168/24, both .100–.200)

Fig 12 + 13 · DNS Resolver (DNSSEC on) + NAT Outbound (Automatic mode)

Firewall → Rules → LAN tab

Order matters. Top-down, first match wins. Add rules in this exact order:

Aliases needed: OUTBOUND_WEB = ports {80, 443, 53, 123} · RFC1918 = standard 10/8 + 172.16/12 + 192.168/16 · DMZ_NET = 172.16.0.0/24.

Install Ubuntu Server 26.04

1. Create VM 101 · 2 vCPU · 2 GB RAM · 25 GB disk · NIC on vmbr1
2. Mount Ubuntu Server live ISO · boot · install with default partitioning
3. Set hostname (e.g. jumpbox) · admin user tct_jumpbox
4. ✓ Install OpenSSH server · skip snaps
5. Reboot · log in

Configure UFW

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow from 10.10.10.0/24 to any port 22
sudo ufw allow from 192.168.0.0/24 to any port 22
sudo ufw allow from 172.16.0.0/24 to any port 22
sudo ufw enable
sudo ufw status verbose

Harden sshd (later)

Edit /etc/ssh/sshd_config · change Port 2222 · PermitRootLogin no · PasswordAuthentication no after key auth · AllowUsers tct_jumpbox

Install Win Srv 2025 Datacenter Eval

1. Create VM 102 · UEFI BIOS (OVMF) · 4 GB RAM · 32 GB disk · 2 vCPU
2. NIC: e1000 on vmbr2 · ✓ Proxmox firewall
3. Mount Win Srv 2025 EVAL ISO · boot · run installer
4. Pick Datacenter Evaluation (Desktop Experience)
5. Custom partition: use the full disk · install (~10 min)
6. Set Administrator password · sign in
7. Server Manager opens automatically

Set static IP (GUI path)

1. Win + R → ncpa.cpl → Network Connections
2. Right-click Ethernet → Properties
3. Double-click Internet Protocol Version 4 (TCP/IPv4)
4. Use the following IP address:
   • IP: 192.168.0.15
   • Mask: 255.255.255.0
   • Gateway: 192.168.0.1
   • DNS: 192.168.0.1
5. OK · OK · close

Install Ubuntu Server

1. Create VM 105 · 2 vCPU · 2 GB RAM · 32 GB disk · virtio NIC on vmbr2
2. Mount Ubuntu Server live ISO · boot · run subiquity installer
3. Network step: edit ens18 IPv4 → Manual:
   • Subnet: 192.168.0.0/24
   • Address: 192.168.0.20
   • Gateway: 192.168.0.1
   • Name servers: 192.168.0.1
4. Default proxy + mirror · Use entire disk (LVM default)
5. Profile: hostname linuxserver · admin user · password
6. ✓ Install OpenSSH server · skip snaps
7. Wait for install · Reboot now

⚠ Detach ISO before reboot

Proxmox UI → VM 105 → Hardware → CD/DVD Drive → Edit → "Do not use any media" → OK. Otherwise the VM loops back into the installer.

Post-boot

sudo systemctl enable ssh
# confirm static .20 took effect:
ip -br addr
ping -c 2 192.168.0.1

✅ Build verified (2026-05-06)

• Bridges vmbr0/1/2 · all UP · correct IPs
• pfSense2 routing all traffic · NAT auto · DHCP both subnets · DNSSEC on
• 9-rule LAN firewall enforcing defense-in-depth
• Jumpbox · UFW configured · internet via pfSense
• WinSrv at static 192.168.0.15 · DHCP No · DNS pfSense
• LinuxServer at static 192.168.0.20 · sshd active
• 21 of 25 verification screenshots captured

📋 What's next — Phase 1 services

• Disable pfSense LAN DHCP (avoid conflict with Win DHCP role)
• WinSrv: Time zone Pacific → Central · Windows Updates
• WinSrv: Install AD-DS · DNS · DHCP · IIS roles
• LinuxServer: NGINX · MariaDB · NTP · UFW
• VM 104: Install Ubuntu Desktop · static .25 · Firefox client testing
• 🚨 Critical: change pfSense admin password (still default pfsense)

The next slides walk through the service installs, in order.

Ping matrix — three zones

# from the Proxmox host shell:
ping -c 4 172.16.0.1     # pfSense DMZ
ping -c 4 172.16.0.100   # Jumpbox
ping -c 4 192.168.0.15   # WinSrv
ping -c 4 192.168.0.20   # LinuxServer

Outbound through pfSense (NAT proof)

From WinSrv cmd:

curl -v -m 5 https://www.microsoft.com
expect HTTP 200 in <1 s

From LinuxServer bash:

curl -s https://ifconfig.me
→ returns the school's public IP

If outbound fails: check VM gateway = 192.168.0.1 (pfSense LAN), pfSense's Firewall → NAT → Outbound shows Mode = Automatic, and the LAN allow rule at Firewall → Rules → LAN permits the destination port.

⚠ ping 1.1.1.1 from LAN won't reach the internet — by design, the LAN firewall only allows ICMP echoreq to the gateway. Use curl against an OUTBOUND_WEB-listed port (80/443/53/123) instead.

Add the A record

1. Right-click your new zone → New Host (A or AAAA)
2. Name: winserver
3. IP address: 192.168.0.15
4. Check "Create associated pointer (PTR) record"
5. Add Host → Done

Verify from cmd on the server

nslookup winserver.teamx.local
Server:  localhost
Address: 127.0.0.1

Name:    winserver.teamx.local
Address: 192.168.0.15

📸 Screenshot the DNS Manager tree showing the zone + A record, and the nslookup output.

Activate & test

• Right-click the scope → Activate
• Right-click server node → Authorize (if prompted)
• On a client VM (Win 10/Ubuntu/Kali), set NIC to DHCP
• Release + renew — client should pull an IP in .10–.100

Verify from the client

Windows client:
ipconfig /release
ipconfig /renew
ipconfig /all

Linux client:
sudo dhclient -r && sudo dhclient
ip -4 addr

📸 Screenshot the DHCP Manager scope + Address Leases panel showing at least 1 active lease.

Welcome page content

<html>
  <body>
    <h1>Welcome to Week 2!</h1>
  </body>
</html>

Test from a client VM

Browser:
http://192.168.0.15

Or by hostname (DNS working):
http://winserver.teamx.local

You should see Welcome to Week 2! rendered as an H1.

📸 Screenshot the browser showing the welcome page — URL bar visible.

Install & enable

sudo apt update
sudo apt install nginx -y

sudo systemctl enable nginx
sudo systemctl start nginx

sudo systemctl status nginx
● nginx.service - A high performance web server
   Active: active (running)

Deploy the welcome page

echo "<h1>Welcome to Linux Week 2</h1>" \
  | sudo tee /var/www/html/index.html

# confirm file:
cat /var/www/html/index.html
<h1>Welcome to Linux Week 2</h1>

Test from another VM

Browser on Windows / Jump Box:
http://192.168.0.20

📸 Screenshot the browser with URL + rendered heading.

If it fails, check: sudo ufw status (allow port 80 if firewall up), NIC IP is actually .3, and gateway is .1.

Install & start

sudo apt install mariadb-server -y
sudo systemctl enable mariadb
sudo systemctl start mariadb

sudo mysql
MariaDB [(none)]>

Optional but recommended: sudo mysql_secure_installation — set root password, remove anon users & test DB.

Create DB + user + grants

CREATE DATABASE capstone_db;

CREATE USER 'capuser'@'localhost'
  IDENTIFIED BY 'securepass';

GRANT ALL PRIVILEGES ON capstone_db.*
  TO 'capuser'@'localhost';

FLUSH PRIVILEGES;
EXIT;

Verify from the shell

mysql -u capuser -p -e "SHOW DATABASES;"
password: securepass
+--------------------+
| Database           |
+--------------------+
| capstone_db        |
| information_schema |
+--------------------+

📸 Screenshot the SHOW DATABASES; output with capstone_db listed.

Ping both directions

Win cmd:
ping 192.168.0.20

Linux bash:
ping -c 4 192.168.0.15

DNS lookup

Linux terminal:
nslookup winserver.teamx.local
Server:  192.168.0.15
Address: 192.168.0.15#53

Name:    winserver.teamx.local
Address: 192.168.0.15

If this fails but ping 192.168.0.15 works, the client is still pointed at pfSense (192.168.0.1) for DNS — switch its DNS to the WinSrv address (192.168.0.15) so it queries your zone, then re-test.

DHCP lease check

Spin up a fresh Windows 10/Kali/Ubuntu VM on vmbr1 → set NIC to DHCP.

Record the leased IP:
ipconfig /all | findstr IPv4
IPv4 Address . . . . : 192.168.0.101

📸 Screenshot the DHCP Address Leases on the Windows server showing the client's MAC & IP.

📄 Week 2 Report (PDF or Word)

• Cover page — week #, team name, all 4 roles + names
• NAT bridge + connectivity proof — Phase 0 tables filled
• Ping & internet test results
• 5 mandatory screenshots (see right)
• Test summary table — all rows filled, Pass/Fail marked
• Reflections — 1–2 sentences each:
  • Which test was tricky?
  • Which service took longest / was hardest?
  • Any NAT or network issues unresolved?

📸 Required screenshots

1. DNS zone + A record in DNS Manager (tree view)
2. DHCP scope + leases (at least 1 active lease visible)
3. IIS page rendered in a browser (URL bar visible)
4. NGINX page rendered in a browser (URL bar visible)
5. DB CLI query — SHOW DATABASES; showing capstone_db

📊 Team Lead — asset tracker

• Add every VM (Win / Linux / Jump / any clients) as a row
• Columns: name, role, bridge, IP, MAC, OS, vCPU/RAM/disk
• Export the Hardware + Software tabs → include in report

Can't ping between VMs

• Both VMs on the same bridge (vmbr1)?
• Windows Firewall blocking ICMP? (Allow "File and Printer Sharing (Echo Request)")
• Linux ufw up? → sudo ufw allow from 192.168.0.0/24
• VM has a 192.168.0.x IP? (ipconfig/ip a)

No internet from VMs

• Host IP forwarding on? sysctl net.ipv4.ip_forward should say 1
• MASQUERADE iptables rule? iptables -t nat -L POSTROUTING -n -v
• VM gateway set to 192.168.0.1?
• VM DNS reachable (8.8.8.8 pingable from host)?

nslookup returns NXDOMAIN

• Client DNS = 192.168.0.15 (your Win server)?
• DNS zone actually created + has A record?
• Using FQDN winserver.teamx.local not just winserver?
• DNS service running? Services.msc → "DNS Server" → Running

IIS/NGINX: browser can't connect

• Service running? (services.msc or systemctl status)
• Port 80 open on the VM's firewall?
• Trying HTTP not HTTPS? (no cert installed yet)
• Correct IP? telnet <ip> 80 to confirm listening

MariaDB access denied

• User created as 'capuser'@'localhost'? Remote clients need 'capuser'@'%'
• Ran FLUSH PRIVILEGES; after GRANT?
• Password typed exactly (securepass)?
• Remote connection? — open 3306 in firewall, change bind-address in /etc/mysql/mariadb.conf.d/50-server.cnf

DHCP not leasing

• Scope Activated? (right-click scope)
• DHCP server Authorized in AD? (n/a if no AD yet — skip prompt)
• Client actually set to DHCP not static?
• Broadcast reaching server? (same bridge, no VLAN filter)