Cybersecurity Testbed

A Vagrant/VirtualBox-first routed-zone lab for demonstrating segmentation, firewall policy changes, and controlled access from a public zone to protected data through a service tier.

The active workflow uses six headless VMs. The legacy Docker implementation is preserved under legacy-docker/ for reference only.

Quick Start

./setup.sh doctor
./setup.sh configure-storage
./setup.sh up
./scenario.sh deny-all
./scenario.sh allow-public-service
./scenario.sh allow-service-data
./demo.sh all
./test.sh
./setup.sh down

configure-storage points VirtualBox VM storage at /Volumes/Samsung 980/VirtualBox VMs. Run it only when you want to change the host VirtualBox machine folder.

Topology

kali-attacker 172.20.10.50 (managed attacker profile)
  |
public 172.20.10.0/24
  |
public-service-fw 172.20.10.254 / 172.20.20.254
  |
service 172.20.20.0/24
  |
service-protected-fw 172.20.20.253 / 172.20.30.254
  |
protected 172.20.30.0/24

Lab traffic uses VirtualBox internal networks by default. Vagrant NAT adapters are management-only and are not part of scenario traffic.

Scenarios

Scenario	Effect
deny-all	New cross-zone traffic is denied.
allow-public-service	Public zone can reach the service API on TCP/5001.
allow-service-data	Service API can reach protected Redis on TCP/6379, while the attacker still cannot directly reach Redis.
harden	Returns to default deny for cross-zone flows.
status	Prints active firewall state and recorded scenario.

Commands

Command	Purpose
./setup.sh validate	Validate topology, scripts, and Vagrantfile without booting VMs.
./setup.sh up	Start and provision the lab.
./setup.sh status [component]	Show Vagrant VM status.
./setup.sh ssh <component>	SSH into a managed VM.
./scenario.sh <scenario>	Apply a firewall scenario.
./test.sh	Run behavior checks from host and lab VMs.
./demo.sh all	Run the full demonstration sequence.
./monitor.sh start	Capture traffic on firewall VMs.

Structure

apps/                            Active Vagrant app sources
config/topology.yml              VM, route, IP, and replacement contract
vagrant/Vagrantfile              VirtualBox VM definition
vagrant/provision/               Bash provisioning scripts
docs/                            Active architecture and replacement docs
legacy-docker/                   Archived Docker implementation

See docs/VAGRANT.md, docs/TOPOLOGY.md, and docs/REPLACEMENT.md for the detailed workflow.