{"id":4798,"date":"2025-10-09T14:39:23","date_gmt":"2025-10-09T11:39:23","guid":{"rendered":"https:\/\/webembed.gr\/?p=4798"},"modified":"2026-01-07T12:49:20","modified_gmt":"2026-01-07T09:49:20","slug":"building-a-real-world-windows-server-lab-with-monitoring-security-part-2","status":"publish","type":"post","link":"https:\/\/webembed.gr\/el\/building-a-real-world-windows-server-lab-with-monitoring-security-part-2\/","title":{"rendered":"Building a Real-World Windows Server Lab with Monitoring & Security (Part 2)"},"content":{"rendered":"

Network Segmentation & Routing Setup on Ubuntu Server<\/p>\n

Objective:<\/strong> Configure the Ubuntu server as a central router, providing connectivity between lab subnets while enforcing segmentation and security.<\/p>\n

Step 1 – Assign Interfaces and Subnets<\/strong><\/p>\n

    \n
  1. \n

    Open VirtualBox and make sure your Ubuntu VM has at least 2 network adapters<\/strong>:<\/p>\n

      \n
    • \n

      Adapter 1:<\/strong> NAT (for Internet access)<\/p>\n<\/li>\n

    • \n

      Adapter 2:<\/strong> Internal Network for lab VMs (e.g., LabNet<\/code>)<\/p>\n<\/li>\n

    • \n

      Optional: Add more adapters if you want separate networks for Monitoring<\/strong> and Management<\/strong>.<\/p>\n<\/li>\n<\/ul>\n<\/li>\n

    • \n

      Assign static IPs to each interface:<\/p>\n

        \n
      • \n

        Example:<\/p>\n

          \n
        • \n

          eth0<\/code> (NAT\/Internet): 192.168.56.101<\/p>\n<\/li>\n

        • \n

          eth1<\/code> (Lab Subnet): 10.10.10.1\/24<\/p>\n<\/li>\n

        • \n

          eth2<\/code> (Management Subnet): 10.10.20.1\/24<\/p>\n<\/li>\n

        • \n

          eth3<\/code> (Monitoring Subnet): 10.10.30.1\/24<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n

        • Edit Netplan configuration (Ubuntu 24.04 uses Netplan):

          network:
          \nversion: 2
          \nrenderer: networkd
          \nethernets:
          \neth0:
          \ndhcp4: yes
          \neth1:
          \naddresses: [10.10.10.1\/24]
          \neth2:
          \naddresses: [10.10.20.1\/24]
          \neth3:
          \naddresses: [10.10.30.1\/24]<\/p>\n<\/div><\/div><\/li>\n

        • sudo netplan apply<\/p>\n<\/div><\/div><\/li>\n<\/ol>\n

          Step 2 – Enable IP Forwarding<\/strong><\/p>\n

            \n
          1. \n

            Edit sysctl configuration:
            \n

            sudo nano \/etc\/sysctl.conf<\/p>\n<\/div><\/div><\/p>\n<\/li>\n

          2. Uncomment or add the line:
            \n

            net.ipv4.ip_forward=1<\/p>\n<\/div><\/div><\/li>\n

          3. Apply immediately:
            \n

            sudo sysctl -p<\/p>\n<\/div><\/div><\/li>\n<\/ol>\n

            This allows the Ubuntu server to route packets between subnets.<\/p>\n

            Step 3 – Configure NAT (Optional)<\/strong><\/p>\n

            If lab VMs need Internet access:<\/p>\n

              \n
            1. Add a NAT rule with iptables<\/code>:
              \n

              sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
              \nsudo iptables -A FORWARD -i eth0 -o eth1 -m state &#8211;state RELATED,ESTABLISHED -j ACCEPT
              \nsudo iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT<\/p>\n<\/div><\/div><\/li>\n

            2. Save rules:
              \n

              sudo apt install iptables-persistent
              \nsudo netfilter-persistent save<\/p>\n<\/div><\/div><\/li>\n<\/ol>\n

              Step 4 – Configure Firewall for Segmentation
              \n<\/strong><\/p>\n

              Install ufw<\/code> if not installed:<\/p>\n

                \n

              1. sudo apt install ufw
                \nsudo ufw enable<\/p>\n<\/div><\/div><\/li>\n

              2. Set default rules:
                \n

                sudo ufw default deny incoming
                \nsudo ufw default allow outgoing<\/p>\n<\/div><\/div><\/li>\n

              3. \n

                Allow only required inter-subnet traffic:<\/p>\n

                  \n
                • \n

                  Example: allow management to access lab servers:
                  \n

                  sudo ufw allow from 10.10.20.0\/24 to 10.10.10.0\/24
                  \nsudo ufw allow from 10.10.30.0\/24 to 10.10.10.0\/24<\/p>\n<\/div><\/div><\/p>\n<\/li>\n

                • Deny all other traffic by default.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n

                  Step 5 – Configure Lab VMs<\/strong><\/p>\n

                    \n
                  1. Set static IPs for each VM within their subnet. Example:\n
                      \n
                    • \n

                      Windows File Server (Lab subnet): 10.10.10.10\/24, Gateway: 10.10.10.1<\/p>\n<\/li>\n

                    • Windows Client (Management subnet): 10.10.20.10\/24, Gateway: 10.10.20.1<\/li>\n<\/ul>\n<\/li>\n
                    • Set Ubuntu router as the default gateway for each subnet.<\/li>\n
                    • Test connectivity:
                      \n

                      ping 10.10.10.1 # From a lab VM
                      \nping 10.10.20.1 # From management VM<\/p>\n<\/div><\/div><\/li>\n<\/ol>\n

                      Step 6 – Optional: DHCP \/ DNS on Ubuntu<\/strong><\/p>\n

                        \n
                      1. Install isc-dhcp-server<\/code>:
                        \n

                        sudo apt install isc-dhcp-server<\/p>\n<\/div><\/div><\/li>\n

                      2. Configure \/etc\/dhcp\/dhcpd.conf<\/code> to assign IPs to each subnet.<\/li>\n
                      3. Install bind9<\/code> if you want local DNS for lab hostnames.<\/li>\n<\/ol>\n

                        Step 7 – Verify Network Segmentation<\/strong><\/p>\n

                          \n
                        1. \n

                          Test ping between subnets:<\/p>\n

                            \n
                          • \n

                            Lab \u2194 Management: Allowed if rules permit.<\/p>\n<\/li>\n

                          • \n

                            Lab \u2194 Monitoring: Allowed only for logging\/monitoring.<\/p>\n<\/li>\n

                          • \n

                            Lab \u2194 Internet: Allowed via NAT.<\/p>\n<\/li>\n<\/ul>\n<\/li>\n

                          • \n

                            Ensure unauthorized subnet traffic is blocked via ufw<\/code>.<\/p>\n<\/li>\n<\/ol>\n

                            Result:<\/strong><\/p>\n

                              \n
                            • \n

                              Ubuntu server acts as a central router and firewall<\/strong>, connecting multiple subnets.<\/p>\n<\/li>\n

                            • \n

                              Segmentation ensures isolation between lab, monitoring, and management environments.<\/p>\n<\/li>\n

                            • \n

                              Lab VMs can communicate only according to the defined rules<\/p>\n<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"

                              Network Segmentation & Routing Setup on Ubuntu Server Objective: Configure the Ubuntu server as a central router, providing connectivity between lab subnets while enforcing segmentation and security. Step 1 – Assign Interfaces and Subnets Open VirtualBox and make sure your Ubuntu VM has at least 2 network adapters: Adapter 1: NAT (for Internet access) Adapter […]<\/p>\n","protected":false},"author":1,"featured_media":4816,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[77,1,78,74,3,4,76],"tags":[132,144,140,138,134,141,145,146,137,133,113,139,143,136,110,135,142,108,147,131],"class_list":["post-4798","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cloud-computing","category-cybersecurity","category-data-privacy-protection","category-digital-transformation","category-how-to-guides","category-tech-insights-trends","category-tech-driven-business-strategy","tag-active-directory","tag-case-study","tag-cybersecurity-lab","tag-endpoint-monitoring","tag-file-server","tag-it-infrastructure","tag-lab-environment","tag-monitoring-logging","tag-network-segmentation","tag-rds","tag-security-monitoring","tag-security-onion","tag-sysadmin-best-practices","tag-system-administration","tag-threat-detection","tag-virtual-lab","tag-virtualization","tag-wazuh","tag-windows-client-management","tag-windows-server-2025"],"_links":{"self":[{"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/posts\/4798","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/comments?post=4798"}],"version-history":[{"count":5,"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/posts\/4798\/revisions"}],"predecessor-version":[{"id":4883,"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/posts\/4798\/revisions\/4883"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/media\/4816"}],"wp:attachment":[{"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/media?parent=4798"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/categories?post=4798"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/tags?post=4798"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}