Report: secure infrastructure lab

October 2026 · OPNsense · Active Directory · Debian · Zabbix · VMware

Level 6 qualification project: a small virtualised company network, split into zones, hardened, monitored, then tested with simulated incidents.

Context and goals

Rebuild a small company's infrastructure on a single computer and secure it end to end: separate network zones, a central directory, a hardened Linux server, monitoring, then incident handling with an evidence file.

Period: August to October 2026
Setting: Final project for the French level 6 "Secure Infrastructure Administrator" qualification
Platform: 5 virtual machines on VMware Workstation

Architecture

The OPNsense firewall separates the internal network (LAN) from the exposed zone (DMZ).

OPNsense: firewall and router between zones, explicit filtering rules
Windows Server 2025: Active Directory, DNS and DHCP for the internal network
Windows 11: domain-joined client that receives the GPOs
Debian 13: hardened server
Zabbix: monitoring of machines and services

Implementation

The firewall follows one simple rule: deny everything by default, then open only the flows that are needed. The DMZ cannot open connections to the LAN: if an exposed server is compromised, the attacker stays locked in its zone.

On the Windows side, the domain controller centralises accounts and hands out addresses and names. Group Policies (GPOs) are applied and checked on the Windows 11 client.

The Debian server is hardened: SSH login forbidden for root, firewall enabled with logging.

# /etc/ssh/sshd_config (excerpt)
PermitRootLogin no

# firewall: deny all, allow SSH, log
ufw default deny incoming
ufw allow 22/tcp
ufw logging on
ufw enable

Tests and results

A connection from the DMZ to the LAN is blocked by OPNsense, and the block shows up in the logs
GPOs are correctly applied to the domain-joined Windows 11 client
A root SSH login attempt on the Debian server is refused
Zabbix reports the state of every machine and raises alerts on problems

Simulated incidents

Incidents were triggered on purpose and handled as in a real company: detection, analysis, fix, then an evidence file (screenshots, logs) and lessons learned so the issue does not happen again.

Takeaways

Network segmentation greatly limits the impact of a breach
A test that proves a block is worth more than a rule you assume works
Documentation and evidence are part of the job, not an afterthought