The Course Model: Three Zones Around an OPNsense Firewall

Time to assemble the model you will find in every hands-on exercise in this course. It brings together four virtual machines around a central OPNsense firewall, which has three separate network interfaces, one per zone: WAN, LAN, and DMZ.

Each zone carries a role and a fixed address block, inherited from the refresher module: the WAN simulates the Internet on 203.0.113.0/24 with the attacker machine, the LAN hosts an ordinary workstation on 192.168.10.0/24, and the DMZ isolates a web server deliberately exposed on 192.168.20.0/24. This DMZ (demilitarized zone) is the heart of the following modules' subject: a server that must be reachable from the outside always sits apart from the internal network, never inside it.

The Exercises' Recurring Scenario

Every lab in this course replays the same scenario, at increasing depth: the attacker machine, on the WAN, tries to reach the DMZ web server and the LAN client workstation; the OPNsense firewall must let through what is legitimate (a LAN client browsing the Internet, a WAN visitor viewing the published website) and block everything else, in particular any attempt from the DMZ toward the LAN.

The OPNsense firewall publishes the DMZ web server to the WAN through a port forward, detailed in the next module: a WAN address and port are translated to the server's internal address. Seen from the attacker, a single public address answers; seen from the firewall, that address redirects precisely to 192.168.20.10, never any further into the network.

Key takeaway

• The model brings together three zones (WAN, LAN, DMZ) around a three-interface OPNsense firewall, one interface per zone.
• WAN 203.0.113.0/24 simulates the Internet, LAN 192.168.10.0/24 the internal network, DMZ 192.168.20.0/24 the exposed zone.
• A server exposed to the Internet belongs in the DMZ, never in the LAN: that is the principle the segmentation modules build on.
• A single public WAN address redirects, through the firewall, to the DMZ server, without ever directly exposing the LAN.

Exam trap: a question showing a single public address answering for an internal service sometimes looks like a flaw. It is the normal port-forwarding mechanism: the public address is only a facade, translated by the firewall to a precise internal address.

*Checked on September 27, 2026 against the OPNsense documentation (Firewall, NAT, Destination NAT / Port Forward).*