# Chapter 3 - Networking > Understanding how traffic flows through the cyber range is one of the most important skills for penetration testing. Before attacking systems, you should understand exactly how hosts communicate, how routers forward packets, and how segmentation affects an attack. --- # Objectives After completing this chapter you should understand: * IPv4 addressing * Subnets * Default gateways * DNS * Routing * NAT * Virtual bridges * Firewall segmentation * Dual-homed systems * Attack paths within the lab --- # Enterprise Network Overview Our lab is designed to simulate a small business. ```text Internet | Home Router | 192.168.1.0/24 | Proxmox Host | vmbr0 | pfSense +------------------+------------------+ | | | vmbr1 vmbr2 vmbr3 Attack LAN Corporate LAN DMZ 10.10.10.0/24 10.10.20.0/24 10.10.30.0/24 ``` Only **pfSense** connects these networks together. No VM can communicate between networks unless pfSense routes the traffic. --- # IP Addressing Plan ## Home Network Purpose Management only. Subnet ```text 192.168.1.0/24 ``` Example ```text Router 192.168.1.1 Proxmox 192.168.1.100 pfSense WAN 192.168.1.150 ``` --- ## Attack Network Subnet ```text 10.10.10.0/24 ``` Gateway ```text 10.10.10.1 ``` Hosts ```text Kali Pivot Host ``` --- ## Corporate Network Subnet ```text 10.10.20.0/24 ``` Gateway ```text 10.10.20.1 ``` Hosts ```text DC01 WIN10-01 WIN10-02 FILE01 SQL01 LINUX01 BOF-WIN7 ``` --- ## DMZ Subnet ```text 10.10.30.0/24 ``` Gateway ```text 10.10.30.1 ``` Hosts ```text WEB01 ``` --- # Static Addressing Infrastructure should always use static IP addresses. Example: | Machine | Address | | ------- | ----------- | | pfSense | 10.10.10.1 | | Kali | 10.10.10.10 | | DC01 | 10.10.20.10 | | FILE01 | 10.10.20.70 | | SQL01 | 10.10.20.80 | | WEB01 | 10.10.30.10 | This prevents services from changing addresses unexpectedly. --- # Default Gateway A default gateway is where traffic is sent when the destination is outside the local subnet. Example: Kali ```text IP Address : 10.10.10.10 Mask : 255.255.255.0 Gateway : 10.10.10.1 ``` Suppose Kali connects to: ```text 10.10.20.10 ``` Since that address is outside the local subnet, Kali forwards the packet to **10.10.10.1 (pfSense)**. pfSense then forwards the traffic to the Corporate LAN. --- # Packet Flow Example: Kali scans the Domain Controller. ```text Kali 10.10.10.10 | | V pfSense 10.10.10.1 10.10.20.1 | | V DC01 10.10.20.10 ``` Understanding this flow is critical when troubleshooting firewall rules or pivoting. --- # DNS Initially: Clients use pfSense. Later: Corporate machines should use the Domain Controller as their DNS server. ```text 10.10.20.10 ``` This enables: * Active Directory * Kerberos * LDAP * Group Policy * Service discovery --- # Linux Bridges A Linux bridge acts like a virtual Ethernet switch. ```text vmbr2 +--------+--------+ | | | WIN10 FILE01 SQL01 ``` No routing occurs inside a bridge. Routing only occurs through pfSense. --- # Why We Don't Need More Physical NICs Many beginners think each network requires another Ethernet port. Not in virtualization. Each Linux bridge is an isolated virtual switch. Because every VM exists on the same Proxmox host: * vmbr1 * vmbr2 * vmbr3 are completely independent even though only vmbr0 uses a physical cable. This is one of the biggest advantages of virtualization. --- # Dual-Homed Hosts A dual-homed host has two network interfaces. Example: ```text NIC 1 10.10.10.20 NIC 2 10.10.20.50 ``` This machine exists on two networks simultaneously. It becomes useful for learning: * Ligolo-ng * Chisel * SSH tunneling * SOCKS proxies * Meterpreter routing --- # Network Segmentation Our lab intentionally separates systems. Attack Network * Kali Corporate * Users * Servers * Active Directory DMZ * Public web server This mirrors a real enterprise where servers and user devices are not placed on the same network. --- # Example Attack Path A typical penetration test might follow this route: ```text Internet | V WEB01 | Privilege Escalation | Credentials | Pivot Host | Corporate LAN | Windows Workstation | Domain Controller | Domain Admin ``` This sequence demonstrates how attackers rarely compromise a domain controller directly. --- # Common Networking Commands Linux Show interfaces ```bash ip addr ``` Show routes ```bash ip route ``` Ping ```bash ping 10.10.20.10 ``` DNS lookup ```bash nslookup lab.local ``` Traceroute ```bash traceroute 10.10.20.10 ``` --- Windows Display configuration ```powershell ipconfig /all ``` Show routing table ```powershell route print ``` Test connectivity ```powershell ping 10.10.20.10 ``` DNS ```powershell nslookup dc01.lab.local ``` --- # Troubleshooting ### Cannot Reach Another Network Check: * Correct IP address * Correct subnet mask * Correct gateway * Firewall rules * Bridge assignment --- ### Internet Doesn't Work Verify: * WAN IP * Gateway * NAT * DNS --- ### Hosts Cannot Resolve Names Verify: * DNS server * Active Directory DNS * pfSense DNS Resolver --- ### VM Cannot Communicate Check: * Proxmox bridge * NIC status * IP address * Gateway * pfSense rules --- # Validation Checklist Before moving to the next chapter: * [ ] Understand the purpose of each subnet * [ ] Verify every VM has the correct gateway * [ ] Confirm Internet access from Kali * [ ] Confirm Kali can reach the Corporate LAN * [ ] Confirm Kali can reach the DMZ * [ ] Verify DNS resolution * [ ] Understand packet flow through pfSense * [ ] Understand why Linux bridges replace physical switches in this lab --- # Next Chapter The next chapter covers the deployment of **Active Directory**. You'll build a realistic Windows domain including: * Domain Controller * DNS * Organizational Units (OUs) * Users * Groups * Group Policy * Domain-joined workstations * Service accounts * Common enterprise misconfigurations for security testing By the end of the next chapter, you'll have the foundation of a Windows enterprise ready for enumeration, Kerberos attacks, SMB testing, privilege escalation, and lateral movement.