HOME LAB SETUP
In this page I will explain how I setup my own home lab in detail. The process will be broken down in stages and explained via the use of images, diagrams and supporting text.
The lab will consist of six different parts:
- VirtualBox Setup
- Deploying Windows 11 Enterprise
- Configuring pfSense (GUI) and firewall rules
- Deploying Windows Server 2025
Tools used: Oracle VirtualBox as a Hypervisor, Windows 11 Enterprise, pfSense, and Windows Server 2025
The diagram below shows the intended final result of the lab. I have created it using the official Cisco network icons and symbols.
1. VirtualBox Setup
As my hypervisor I have used Oracle's VirtualBox, which is a Type2 Hypervisor. This means that the OS is hosted inside my pre-existing OS. It is also fairly user friendly, making it ideal for personal testing. Before running any VM I had to first check if my virtualization was enabled. This can be done in Task Manager (CTRL+ALT+DELETE) checking the CPU under the Performance tab. If virtualization is not enabled then a restart will be necessary to enter the BIOS setup and enable it.
2. Installing pfSense
pfSense is an open source firewall and router by Netgate. It based on the FreeBSD OS and the CE (Community Edition) is available for free. I first came across pfSebse during my CompTIA (Network+) study labs.
For my home lab I will use it to isolate my home network from the virtual AD network. It will also help me to simulate a DMZ for an enterprise environment.
pfSense can be downloaded from: https://www.pfsense.org/download/ . The downloaded file appears with a .gz , meaning that it is a zip file. For the purpose of unpacking you can use 7Zip , WinRar, WinZip etc. You can then extract the contents of the zip and create a folder with the same name as the file. After doing so we can see a single .Iso file is located within the folder.
The next step is to open VirtualBox and select ''New'' button in the top left corner or (CTRL+N) and open our .iso file. It will then give me a series of menus with which i can configure my VM. It will first ask for the name of the virtual machine, which for this purpose I went with something easy ''Lab_pfSense''.
The following step is to set up your resources for the VM. In my case I have limited resources available (32GB RAM +8 cores). I will assign 4GB or RAM to pfSense and 2 Processor cores for the installation. This is something that can be changed after the installation is complete, should you wish to increase or decrease the resources.
In the image above we can also see a ''Boot Device Order (BIOS only) menu. Here in my case I will select - Hard Disk and Optical (for the installation). The optical is our (.iso) file that we use for the installation of pfSense, Windows, Linux etc. Once the installation has finished and our system is ready to go, we can deselect the Optical drive from the boot order. Not doing so will cause a loop, every time you start up the system it will automatically go into the setup mode. Leaving only Hard Disk checked will cause the system to boot as intended.
Apart from the RAM your VM/System also requires some dedicated storage to be assigned to it. That size can vary depending or your resources or needs. In my case my machine only has 1TB of storage, I assigned only 20GB in this case. Under the Hard Disk File Type and Format we can see that there is an option: Pre-allocate Full Size. Enabling this would immediately reserve the 20GB of space from the host system storage regardless of how much space do the VM's files take.
The final phase of my setup is the Network where i set up my LAN adapters. VirtualBox gives you four adapter tabs: Adapter 1/2/3/4. Before we can adjust any setting the adapter needs to be enabled. In my case I will use three adapters to set up my WAN, therefore pfSense will act not only as a firewall but it will also serve as a router. The first adapter will be my Home router, for pfSense to get it's IP address from it, I will select the ''Bridged Adapter'' setting. Selecting the ''NAT'' option would mean that my VM will be getting it's IP from VirtualBox. Adapters 2 and 3 will be for the Private LANs, which will be attached to private network, therefore the networking will be done via VirtualBox. We can leave the adapter type to Intel PRO/1000 MT Desktop.
After all the required options are selected, we can select ''OK'' and review all what we have assigned as seen by the images below.
Now that I am happy with the assigned setting I can launch the installation for pfSense. The first thing it will do is prompt you to Accept a Copyright and Distribution Notice. It will then ask you to setup the network to continue with the installation, select okay to the default WAN that it is showing, this together with the LAN interfaces will be assigned later. I have not uploaded screenshots of the installation due to me mostly selecting the default options for this lab. Some other things to note during the installation is that it will ask you to select the Hard Drive, where it will show you the 20GB that I assigned from VirtualBox. The final question before proceeding to install is, which version of pfSense you would like to install. I have selected the ''Current Stable Version 2.8.1''. pfSense will then proceed to install by downloading, decompressing and installing the packages. It's worth noting that the pfSense installation is going to be longest from all of the other VM's in my lab. Once the installation has finished it will ask you for a reboot and once that is done you should be able to see the Main Menu page as illustrated in the screenshots below.
2.1 Configuring pfSense from Command Line
Using the options provided within the menu of pfSense we can select option 1) Assign Interfaces, to begin our WAN/LAN configuration. Once selected it will then ask: Should the VLANs be set up no, to which I press N - no. It will then ask you to enter a WAN interface name. I will use the first provided name - em0. After I have selected the WAN name it will also ask me to name my LAN interfaces, and again I will use the second and third provided option - em1 & em2. Finally we can see on the second screenshot below that It has assigned my WAN -> em0 , LAN -> em1 and OPT1 -> em2.
OPT is an extra (Optional) interface is pfSense which can be used as an extra LAN, DMZ or guest networks. In my case I am adding an extra LAN in case I decide to add another VM to a different LAN, for example to simulate a different department in my ''Corporate Scenario''.
Once the interfaces are assigned, it will ask me if I wish to proceed to which i press Y - yes.
Now that the interfaces are set it will return to the main menu list of options. The next step will be 2) Set Interface(s) IP address. Here I will set up the address ranges for both my LAN's. I will not touch the WAN options since it will be receiving it's IP from my home router.
After selecting option 2, it gives me the list of available interfaces. I can then choose 1, 2 or 3 depending on which I would like to configure. As mentioned the WAN does not need further configuration, therefore I select 2 to configure LAN (em1). It then asks me if I would like the interface to use DHCP configuration for it's IPv4. I press No as I will assign the IP's manually.
10.0.1.1 Is the IP that the adapter will use. It then asks for the Subnet mask, expressed in CIDR notation. 255.255.255.0 /24 will be the subnet mask, which means that the local network will use a range from 10.0.1.1 to 10.0.1.255. In a /24 the first 24 bits are used for the network portion, while the remaining 8 are the host portion.
The next option will be left empty or I will press <ENTER> for none. To keep the lab simple it will not use IPv6, therefore on the option asking if IPv6 address should be configured via DHCP, I select - no. And again the following option is left empty - <ENTER>.
Finally it asks if I want to enable the DHCP server on the LAN. This is very important as it allows the adapter and the machines attached to it to be able to get there IP's from it. Once agreed it is time to set up the IPv4 address ranges or the available list of IP's that a device could request from the DHCP server.
Normally the range would look like 10.0.1.2 to 10.0.1.254, this is due to 10.0.1.1 being acting as the Default Gateway and 10.0.1.255 being reserved as a Broadcast address. A broadcast address sends data to every single device on that local subnet. In a Corporate scenario you would start you range from a further number. For example 10.0.1.11, this will leave room for IP's from 10.0.1.2 to 10.0.1.10 to be reserved meaning that every time a device would be assigned the same IP. You would want IP reservations for: servers, printers, NATs etc. So for my lab I will use the range 10.0.1.11 until 10.0.1.250. Finally it will ask ''Do you want to revert to HTTP as the web Configurator protocol?'' - No.
I will do absolutely the same for my second LAN, OPT1. The only difference being the IPv4, which is 10.0.4.1. Once all of the configuration is done it will return to the main menu list of options. This time you can see your interfaces (em0, em1, em2) in my case , and their respective IP addresses. On the screenshot above you can also see pfSense telling us that:
You can now access the web Configurator by opening the following URL in your web browser: http://10.0.4.1/
This will be used in the next steps of the home lab (4. Configuring pfSense (GUI) as it will provide us with a more detailed GUI configuration. But before that I will need to install my Windows Host and Server.
3. Deploying Windows 11 Enterprise VM
In this section of the lab I will install my first Windows 11 VM, I can then use it to finish the pfSense configuration through the web browser accessing the GUI menu. To download a Windows 11 .iso image file I can go to Microsoft's Evaluation centre and download an Enterprise Edition, although it should be noted that it lasts a total of 90 days.
https://www.microsoft.com/en-us/evalcenter/evaluate-windows-11-enterprise#Get-started
Once the .iso has been downloaded it can be loaded into VirtualBox and like in the previous pfSense section, resources for it will need to be assigned. For the Windows 11 VM, I have assigned 4GB of RAM and 2 cores for processing, which should be enough resources for the installation and basic functions. For storage 80GB I will allocate dynamically, again disregarding the ''Pre-allocate full size'' option. Generally the more resources assigned to a machine the better, however it is important to understand the limitations of your physical setup and how much resources you can spare.
Unlike the pfSense installation Windows 11 requires the use of EFI (UEFI), and as a result the Boot Device Order options will not be open to editing. The audio can be disabled should you wish to do so, In this case I have kept it. The ''Network'' section is where the difference would be this time. Once the adapter is enabled it would be attached to the Internal Network this time (LAN 0) as shown in the image below.
The reason why this machine is on LAN 0 is to do with the pfSense setup. The interfaces that were setup previously (em1) and (em2) or (lan) & (opt1) are going to be the subnets used for this lab. Therefore the Windows machine will be a part of the (em1) interface or the - 10.0.1.1/24 .
Now that all of the options are set, the VM is ready to be launched. This part will be a Windows installation setup. Once the machine starts it will ask ''Press any key to boot from CD or DVD'', you need to be quick here as the time frame is very low and failure to press a key will lead to a need to reboot. The images below display some of the steps and options that need to be configured during the deployment process.
Initially I the setup asks you to choose a language and time and currency format. As we are in the United Kingdom, this is what will be selected. After clicking ''next'' it will ask for a Keyboard and Input method, which will also be set to United Kingdom. Once that is done the next question that the setup asks is if you would like to Install Window 11 or Repair my PC. In this scenario I choose install and proceed to a reading and accepting a screen with Applicable notices and license terms.
After accepting the terms, the next configuration step is to the disk onto which the system will be installed. In this case what appears is the 80 GB that were allocated during the initial VirtualBox settings. I select the disk and proceed with the installation. This will take some time as Windows advises you, it will also restart a few times during installation. The setup has now reached its final phase where I need do some simple configurations. It will ask for the country and region and then if you would wish to add a second keyboard layout. This is particularly important if you are not a native English speaker, for example you can add a Spanish or Russian keyboard layout that will include the necessary letter from the respective alphabets.
Next it will ask for an internet connection to which I press ''I don't have internet'' as I do not want it to try to connect to my Microsoft Account. This can be seen in the image below.
Now it is time for some security option. The setup will ask ''Who's going to use this device?'', for the purpose of this lab I have created a fictional name - Jack Brown. Now that I have my user, I will have to create a memorable password and answers to memorable questions. For the purpose of a lab environment passwords and answers should be kept easy to remember. However in a real production environment these need to adhere to security policies and should not be reused on multiple devices.
Lastly it will ask me to choose Privacy settings for the device - location, diagnostics, etc. All of these can be turned off as this is a virtual device and none of these will be required.
The setup is now complete! The OS is up and running and we can see the desktop and start menu with the user Jack Brown, in the bottom left corner of the start menu. To further improve the workflow and smoothness of the VM, I am going to install the Guest Addition Package. What this does is, it improves the overall performance of video and graphics, offers shared clipboard and also time synchronization with the host computer.
The following images show where the package can be found. By accessing File Explorer followed by selecting ''This PC'' from the bottom left menu, within our VM, you can the partitions of the OS - Local Disk (C:) and CD Drive (D:) VirtualBox Guest Additions. Once you enter you should look for an application ''VBoxWindowsAdditions-amd64''. After that right click on it and ''Run as Administrator'' and confirm the prompt to open it. It is a simple straightforward installation, which will then ask for the system reboot once it has completed.
As mentioned previously I am now able to share the clipboard between my host PC and the VM. To enable this you can simple go to VirtualBox and click on the setting for the VM in question. Under the ''General'' tab select ''Features'' and enable ''Bidirectional'' Shared Clipboard and Drag-and-Drop.
It should be noted that if you are dealing with any malware this should be disabled!
Before I finish this part of the Lab setup, I am going to run a quick test of my VM's connection to ensure that everything is working properly. I will do this by typing ''Cmd'' in my start menu and opening the ''Command Prompt''. To check my network options I just type in the [ipconfig] command and for the purpose of this test I have shown two outputs as seen in the image below.
The first output provides me with an IP of 169.254.165.83 , also referred to as APIPA. This means that my machine cannot connect to the DHCP server and acquire a valid IP. As a result it can only communicate to devices on the same physical network segment. I receive this output due to not running pfSense at time of the Windows 11 deployment.
The second output is different as it already shows an IP of 10.0.1.11. It can also be seen that this time there is a Default Gateway address 10.0.1.1. This is the router address. The second use of [ipconfig] is while pfSense is running, which means that the VM can connect to the network. Another observation is that our subnet mask is now correctly displayed as 255.255.255.0 as we are on a /24 network.
10.0.1.11 is the IP address it receives as a result of me establishing during the pfSense setup that .11 will be the first available address from the DHCP pool range. The last step would to test the VM's connectivity. This can be done via the [ping] and we can ping 8.8.8.8 - Google's Public DNS resolver. If we get a reply with 4 received packets it means that everything is working correct.
4. Configuring pfSense (GUI) & setting up firewall rules
The following section will be the longest. Here I will access pfSense's (GUI) and configure firewall rules and IP reservations. For this step I will use the browser of the already installed Windows 11 VM. Once Microsoft Edge is opened the (GUI) can be accessed by typing the router's IP address - (Default Gateway) IP. This process will be familiar to those people who have accessed their home router's admin page, for example. If you are unsure what the address is, it can be checked via a quick [ipconfig] command. Once I enter the router's address 10.0.1.1 I will receive an error - ''Your connection isn't private'' - this is because the browser does not trust it. pfSense uses a self-signed certificate, which is considered insecure, however you can go ahead and proceed by pressing ''Advanced'' on the error page followed by ''Continue to 10.0.1.1 (unsafe)''
At the Sign In page, I will use the default pfSesne username (admin) and password (pfSense), upon entering the first thing you notice is a WARNING. This will notify you to change the default password as it is unsafe. It is best security practice to never leave default passwords on any device, therefore I will change it.
Now that the password is changed I can finish the Setup Wizard., it can be accessed from ''System'' located within the menu toolbar up top. The wizard has a total of 9 steps to finish. The first step provides you with support information. The image below shows the second step, which asks me for some General Information. Hostname will be kept as ''pfSense'' and the Domain will be Vcorp.local . For Primary and Secondary DNS server i will leave them as they are and proceed to the next step. Step 3 is an easy one as it asks me about what time zone I am in.
Step 4 displays multiple options, however I will leave them to default values. The most crucial part here is to disable ''Block RFC1918 Private Networks''. The reason behind this is that in this scenario pfSense is located behind my home router, therefore it receives a private IP for its WAN interface. If this option is left enabled it will consider all traffic coming via my home router as malicious, thus preventing my VM's from reaching the internet.
Step 5 asks for LAN configuration, however this will be left untouched as it was already set up before from the command line. Step 6 repeats something that I have already done. It asks me whether I would like to change the default Admin password. After selecting next Step 7 is asking me to click ''Reload'' to make the changes done come into effect. Once that is done a confirmation is received that the wizard setup have been completed.
After completing the setup wizard, I am back at the dashboard and I can see all of my system information on the left side. The next step now will be to rename my Interfaces. This can be done by selecting ''Interfaces'' from the horizontal menu on top and then entering the respective interface that you wish to edit. In my case I will edit both the LAN and OPT1 that I set up previously via the command line of pfSense. This is just a simple renaming step. LAN will be renamed to Vcorp and OPT1 will be renamed to VcorpExternal. The second interface is there in the event of me further developing and installing more machines on a different LAN, for example. Once you are happy with the name setup, just scroll down and click ''Save''
4.1 DNS Resolver Options
Next I will configure the DNS Resolver options. They can be found by clicking on ''Services'' located on the top toolbar menu. Once there we can see that DNS runs on port 53 by default. I will scroll down and enable ''DHCP Registration'' and ''Static DHCP''. As per the description provided for DHCP Registration, you can see that machine requesting an IPv4 DHCP lease will be registered in the DNS Resolver so that their name can be resolved. Static DHCP makes sure that static mappings are registered in the DNS Resolver.
Before finishing the DNS Resolver settings I will go to advanced settings and enable ''Prefetch Support'' and ''Prefetch DNS Key Support''. The rationale behind this is to speed up my website loading times and DNSSEC Security Key validation.
Prefetch refreshes the cached DNS records before they expire so that items stay fresh in the memory, thus keeping items in the background ready before you even click on them. After this is done scroll down and Save.
Once that is done I will go to the ''Advanced'' tab under the System menu from the top toolbar. From the ''Networking'' tab I will select ''Disable hardware checksum offload''. Keeping this option enabled could cause problems due to Virtualized adapters or packet inspection tools like Wireshark. Disabling it will cause pfSense to ask for a system reboot, select Normal reboot and then wait for 90 seconds.
4.2 Configuring DHCP Server and Leases
Now I can explore the options for DHCP Leases. To access them simply select ''Status'' from the top toolbar menu and then ''DHCP Leases'' from the drop down menu. Straightaway what can be noticed is there is a single device with a 10.0.1.11 IP that is connected. This is of course the VM that I am using and the reason why it gets this particular IP is due to the DHCP lease ranges that I set up earlier during the Command line setup. From this page we can add Static mappings to devices, which means that every time the device is powered on it will receive the same IP address.
I will now create a static mapping for this Windows 11 VM that I am using. For the purpose of not making this section overcrowded with screenshots I will rather explain the process. To add a static mapping, select the white box with the ''+'' inside as seen on the second image below. The page that comes up asks for the devices' MAC address, preferred IP and Hostname. The MAC and Hostname are populated automatically, therefore the only thing that needs to be adjusted is the desired IP. I will set this up to 10.0.1.2 and scroll to the bottom of the page and click ''Save''.
To finish off the Static mapping example, I will just check if everything is working okay with my new Static IP mapping. From the command line of the Windows 11 VM, I will run a quick [ipconfig] to check my network options. From the first attempt it is evident that the machine is still using its old 10.0.1.11 address. To fix this I will need to run [ipconfig /release] followed by [ipconfig/renew] . Once that is done the output will now show the newly assigned 10.0.1.2 IP that I have configured. The output can be viewed on the image below.
For the final step in the DHCP server setup I will setup my DNS servers. This can be done by selecting ''Services'' and then ''DHCP Server'' from the drop down menu. Once the page is opened I can select my Vcop LAN and scroll down to ''Server Options''. I will enter two DNS IP's (8.8.8.8) which is Googles public DNS and (1.1.1.1), which is DNS resolver operated by Cloudflare. Both of these are reliable options that pfSense can use. To apply changes select ''Save''
4.3 Setting up Firewall Rules and Aliases
This will be the final part of the pfSense configuration. First I will set up an Aliase and then create some firewall rules. Both options can be accessed via the dropdown menu of ''Firewall'' located on the main toolbar up top.
Aliases are a means of making configuration easier, they can group (IP's, Ports, Networks or URL's) these can then be used to configure firewall rules. Instead of having to type every IP, port number etc. individually, you can use your alias group. For my scenario the alias group that I will create is ''RFC1918'' these are specific Private IP ranges for internal networks. The ranges will include 10.0.0.0 , 172.16.0.0, 169.254.0.0, 127.0.0.0 and 192.168.0.0, the screenshot below illustrates them as entries.
Having created my alias, I can now start adding some firewall rules. As mentioned you can access them via the ''Firewall'' dropdown menu. Firewall rules are used to control traffic flow, they can block or allow traffic or control which devices can communicate between each other. Setting up your firewall rules is one of the most important task to protect a network. pfSense is a Stateful inspection firewall, it monitors the entire lifecycle of a connection. When a connection matches an allow rule, it makes a record of it within its active state table.
The way pfSense functions is using a top-down approach. This means that it checks the rules from top to bottom. The moment a rule applies, all of the rest underneath it are overridden. For example, if the top rule is ''Block All'' it will override any lower ''Allow'' rules.
Following the aforementioned logic I can now add my first rule by pressing them ''Add'' button with the downward pointer arrow. This rule would allow anything that is coming from Vcorp network both IPv4 and IPv6, using any protocol with a Source: Vcorp subnets and Destination: Vcorp Address to pass, effectively allowing all devices on Vcorp to communicate between each other. Thus the rule description will be ''Allow traffic to devices on Vcorp network''.
The second is aimed more at future exercises, as it would allow traffic to pass from Vcrop subnets to VcorpExternal subnets. This is probably not something that you would do in a real life scenario. In the third rule I will demonstrate the use of aliases. Using the previously created RFC1918 alias. The difference in setup here is that in the ''Destination'' section, I will select ''Address or Alias'' followed by typing in RFC1918. Another difference here is that I will select the ''Invert Match'' option.
Inverting means that the rule applies to everything except the specified address or network. So in this case it means that traffic is allowed to any address outside of the private networks, which is the Internet.
The final rule will Block, anything on Vcrop, IPv4 & IPv6 from any protocol Source: Vcorp subnets, Destination: Any. This rule will effectively ''Block access to everything else''. The reason why this rule is last is due to the pfSense top-down approach. The Block rule on the bottom means that traffic is allowed until there is no matching rule, and as a result it gets blocked. The screenshots below show the final rule being added and an overview of all the created rules for Vcorp. Once you are happy with the setup, you can reboot the interface to make the changes come to effect. This can be done via ''Diagnostics'' at the top and selecting ''Reboot'' from the dropdown menu. With this my simple pfSense setup has come to an end, and the section concludes.
5. Deploying Windows Server 2025
In the section I will install my Windows server, which is going to be my Domain Controller (DC). To become a Domain Controller a machine needs to have Windows Server OS installed. A Domain Controller manages user accounts. security and network access for a group of computers. It must have an Active Directory Domain Services (AD DS) installed, which is your central database containing information regarding user accounts and resources on the corporate network.
As with the previous VM's I will start by downloading my .iso file. To get Windows Server 2025 (latest version) I am going to visit Microsoft's Evaluation, similar to how I got the Windows 11 Enterprise .iso. Once the file has been downloaded I will load it within VirtualBox and set up the resources required for this machine. I am going to skip the ''Unattended Installation'', this means that you get to configure the settings as opposed to an automated setup feature. Since Windows Server OS is more demanding I will asign slightly higher resource values at least during the installation.
For RAM I will assign 8GB RAM and 2 CPU's, for storage I will just go with the default 50GB.
Just like the previous Windows 11 installation, we can briefly disable UEFI, to adjust the boot order to be Hard Disk first and Optical second. Once adjusted I will re-enable the UEFI. The next step would be from the ''Network'' tab. I will make sure that the enabled network adapter attaches to ''Internal Network'' & LAN0 giving us the 10.0.1. X IP (depending on DHCP). This step connects the Domain Controller to the pfSense interface. These would be all the adjustments for the settings. I can now proceed to the installation.
Like every Windows installation you need to be quick to hit a key to boot. Once it starts it will ask you about the Language and Time zone. The setup option is what follows and I would like to ''Install Windows Server'', i will also agree to everything being deleted including files, apps, settings. After that I will choose ''Windows Server 2025 Standard Evaluation (Desktop Experience) and proceed to the next step of the installation. A screen with Notices and License terms is presented to you, once accepting you would need to allocate the location of the installation. In my case this is the 50GB drive that i reserved in VirtualBox. After these simple configurations I can proceed to install the Windows Server.
After some time the installation is almost complete, however just before I am ready to start using the OS I am prompted to create a password for the Administrator account so that I am able to sign in to this computer. Since this is a Domain Controller you have to make sure that the password has some complexity to it. This password should also be a well kept secret. Now that the password has been entered I can finally log into this computer.
Notice that a Windows server requires Ctrl +Alt +Delete to bring up the login page. This can create a problem while you are using a VM as Ctrl +Alt +Delete will open the Task Manager on your Host Machine. To prevent that from happening I can simply select Input -> Keyboard -> Insert Ctrl +Alt +Delete from my VirtualBox settings.
Now that I am logged in the first thing that I will do is Install VirtualBox Guest Additions package. And the process is the same as it was for the Windows 11 machine. It can be found by accessing ''File Explorer'' and then selecting the ''CD Drive (D:)'' on the left. Again similar to last time I select the ''amd64'' and run it as administrator. Once the setup is complete it will ask for a reboot.
For the last step of this section I will go to pfSense's (GUI) and create a static mapping for my server. I will open ''Microsoft Edge'' browser and type in 10.0.1.1 in the address bar. Just like last time I will receive an error regarding the certificate, however I will click on ''Advanced'' and then proceed. Once logged in into my pfSense I can select ''Status'' at the top and then select ''DHCP Leases'' from the dropdown menu. From the images below we can see that within the ''Leases'' list currently the Windows Server is obtaining the address of 10.0.1.12. What can also be observed is the Static mapping for the Windows 11 machine that I previously created - 10.0.1.2.
Now I can proceed to create a static mapping for my Domain Controller. This process is a repetition of what I previously did with my Windows 11 machine. Select the white square with ''+'' and then type in a desired IP. In my case I will assign it 10.0.1.3 and setup the DNS Servers to 8.8.8.8 and 1.1.1.1. Once these steps have been complete I will apply my changes.
Finally just before I finalize this part of the setup I will quickly check if my new IP settings have been applied. I will run a quick [ipconfig] command and from the image below it can be observed that my IP is still the initial 10.0.1.12 that was obtained from the DHCP server. To apply the new setting I will simply run [ipconfig /release] follow by a [ipconfig/renew]. Now we can see that the desired 10.0.1.3 IP has been obtained. This concludes the Windows Server 2025 Installation.
5.1 Installing Active Directory (AD)
It is now time to begin setting up my Domain Controller (DC), the first task that I shall undertake is the installation of an Active Directory (AD). An (AD) acts as a central database of users and security settings. This section will only cover the installation part. I have also taken the time to explore Organizational Units (OU), adding users and creating group policies in another simulated exercise - Active Directory Excercise.
Before I proceed with the installation I am first going to rename my PC. To find out what your PC name is, simply type in ''View your PC name'' either in the search bar below your desktop or within the ''Start'' menu search bar. On the screenshots below you can see that once there you can see the current name of your PC. You are then able to assign a new name by clicking on the ''Rename this PC'' button. Since this server is going to be my Domain Controller I will go with something simple - VCorpDC. Once renamed it the OS will ask you to restart the computer so that the new name change to take effect.
Now I can proceed to install the Active Directory. This can be done via the Server Manager Dashboard. From the top right menu options select ''Manage'' --> ''Add Roles and Features''. The first page shown is going to give you some information an tips about what you should have done so far. After clicking next you are then asked about the installation type. For this lab I will go with ''Role-based or feature-based Installation'' as I am working with this server only. Remote Desktop Services Installation is for a multi-server production where you need automatic deployment. After selecting ''Next'' will show the list of available servers in my case I have only one the 10.0.1.3.
Now it gives you a list with Server Roles and you can select your desired one. In my case I will select ''Active Directory Domain Services'' (AD DS), doing so will present me with a pop up Window that explains what features need to be with the AD. I will select ''Add Features'' and then click next. I will be presented with another list of additional features that I can add. I will keep things simple and click next. The final page of the installation gives you general information regarding Active Directory once you press ''next'' you can then confirm the installation. Since the installation itself has many steps I have created a sliding gallery of images below that illustrate the steps that I have described.
Once the installation has succeeded it is important to select ''Promote this server to a domain controller'' and once I do that I can then start my deployment configuration. Here I am going to select ''Add a new forest'', which means that I would like to create a new Independent AD structure with its own root domain. I am then going give a Root domain name - VCorp.local .
The next step of the setup is to create a Directory Services Restore Mode (DSRM) password, do not reuse the same passwords in a real-life production environment. Continuing forward on DNS options I receive a warning '' A delegation for this DNS server cannot be created because the authoritative parent zone cannot be found''. This error can be ignored as it does not affect the new forest setup. This error occurs due to the new forest root sitting above existing local zones.
The next steps are simple and I can click next through them. First it asks me to verify the NetBIOS name assigned to the domain. VCORP is what appears, which is correct. Following this It shows me the default ''Paths'' or locations where my AD DS database, log file and SYSVOL are located. The setup then gives you the chance to review your selections and after that you will have to wait for a ''Prerequisites Check''. Once that is done I can press ''Install'' and after it has finished the system will Sign me out and restart in order to complete the installation. Follow the images from the sliding gallery below to see the steps and choices that I have described.
5.2 Installing Active Directory Certificate Services
Once the server starts back up the next step is to configure my Certificate Services. The process is similar to that of the AD, from the Server Manage Dashboard select ''Add Roles and Features'' and like previously this will be a Role-based or feature based installation. I will select my server from the list and then proceed to the ''Server Roles'' page where I will select ''Active Directory Certificate Services'' and just like before I will press ''Add Features'' and then proceed. From here I can skip the additional features page and then view the information regarding Active Directory Certificate Services.
The next step is to select role services, in my case I choose ''Certification Authority'', which can issue and manage certificates. This is a part of the Public Key Infrastructure (PKI). A Certificate Authority (CA) will verify the identity of devices and people. Just before I confirm the installation I will select ''Restart the destination server automatically if required'' and then proceed to wait for the installation to be completed.
The installation is complete I can now configure the Certificate Services on the destination server. I am then asked for the credentials which are - VCORP\Administrator, therefore I do not need to change anything. From Role Services I will select Certificate Authority to configure and click next. The following page asks me to ''Specify the type of the CA'' for an AD integration I will select ''Enterprise CA''.
Now I have to ''Specify the type of the CA'' and in my case I need a ''Root CA''. This means that it will sit on top of the chain of trust and it will be signed with its own private key. Under the Root CA you have your ''Subordinate CA's'' which will handle other operations.
As mentioned above the Root CA will be signed by its own private key, and the next step is to create one. For cryptographic options I will select SHA256 as the hash algorithm and RSA#Microsoft Software Key Storage Provider with a key length 2048. The next page gives me the CA name, I will leave it as it is and continue. And now i can select the validity period, which will be 5 years. After this I can see my database locations in the (C:) drive if there is nothing to change I can click next and proceed to confirm my configuration. With this the installation of the Certificate Services is complete.
6. Domain Joining (Windows 11 VM)
This section is going to be the last of the lab setup. I am going to join my Windows 11 VM to the Domain that I have created. I will start by setting the DNS settings of the machine to the IP of the Domain Controller. When the Active Directory was installed DNS was included, therefore the Domain Controller will act as a DNS server for all of the machines within the domain.
To change the DNS setting I need to access the Network and Internet settings. These can be found by right clicking on the bottom right of the taskbar the network icon between the language and volume settings. Now that this is done I can access the Ethernet settings and Edit my IP settings.
Currently my settings are set to Automatic (DHCP), I am going to change that to manual. I will then have to enter the IP address, since I have already assigned a static IP with pfSense I will keep it as 10.0.1.2 to avoid any conflict. The subnet mask is going to be 255.255.255.0 . As mentioned before the Default Gateway value will be the address of the router 10.0.1.1. The most important part here is to change the ''Preferred DNS'' to 10.0.1.3, which is the Domain controller IP. Now that I have saved the settings i can quickly double check my options from the page view.
After configuring my network settings i can now proceed to connect the computer to the Domain. To do so I will type domain in the search bar or in the start menu search. Once that is typed ''Access work or school'' option shows up, I can press that and ''Add a work or school account'' via the connect button. On the set up a work or school account you can see that it gives you a few different options. In my scenario i can ignore the email address field and proceed with the ''Join this device to a local ''Active Directory domain''
The next steps are very straightforward, I will have to type in my domain name - VCorp.local. and then it will ask for a domain admin account, and I can use my default Administrator username and password. After typing in the credentials I can add this account and I will keep the Administrator user and administrator account type. The only thing left to do now is to restart the VM once given the prompt. With this the configuration can come into effect.
I can now log in with any account associated with the domain. First I will log in with the default Admin account and check the name of my PC. By typing ''View this PC name'' I can see that currently the PC is named ''DESKTOP-JJA4B6N'' and I need this information to double check if the computer has successfully joined the domain. To finish the check I can then go to my Domain Controller and access ''Active Directory Users and Computers'' and see that ''DESKTOP-JJA4B6N'' is appearing in the list of computers. This is evidence that the computer has successfully joined the domain.
Lastly I can test if I am able to log in with one of the Users that I created during my Active Directory Exercise. I will use the account of Clare Scott. For the login i will have to select ''Other user'' from the bottom left corner and then type in my domain name with a ''\'' and the name for the account: VCORP\cscott . The result is success and with this my home lab setup is finished.
The idea is to continue developing my skills, using this setup as a base platform.
