vtino17/network-security-lab
GitHub: vtino17/network-security-lab
一套集成防火墙、SIEM、监控和自动化部署的企业级网络安全实验室架构方案，提供多 VLAN 分段与端点加固的完整参考实现。
Stars: 1 | Forks: 0
# 网络安全实验室
[](LICENSE)
[](https://github.com/vtino17/network-security-lab/stargazers)
[](https://github.com/vtino17/network-security-lab/commits)
[](https://github.com/vtino17/network-security-lab)
[](https://mikrotik.com)
[](https://wazuh.com)
具备集成监控、SIEM、防火墙管理和自动化部署的企业级网络安全架构。
## 架构概述
```
graph TD
Internet[Internet] --> pfSense[pfSense Firewall]
pfSense --> VLANSwitch[Managed Switch]
subgraph VLAN10[Management Network 10.0.10.0/24]
AdminWS[Admin Workstation]
JumpHost[Jump Host]
end
subgraph VLAN20[Server Network 10.0.20.0/24]
Wazuh[Wazuh SIEM]
Prometheus[Prometheus]
Grafana[Grafana]
ELK[ELK Stack]
DNS[DNS Server]
end
subgraph VLAN30[IoT Network 10.0.30.0/24]
IoT[IoT Devices]
end
subgraph VLAN40[Guest Network 10.0.40.0/24]
Guest[Guest Access]
end
subgraph VLAN50[VoIP Network 10.0.50.0/24]
VoIP[Voice Traffic]
end
VLANSwitch --> VLAN10
VLANSwitch --> VLAN20
VLANSwitch --> VLAN30
VLANSwitch --> VLAN40
VLANSwitch --> VLAN50
Wazuh -.->|Log Collection| AdminWS
Wazuh -.->|Syslog| pfSense
Prometheus -.->|Metrics| Wazuh
Grafana -.->|Visualize| Prometheus
```
## 组件
| 组件 | 用途 | VLAN |
|-----------|---------|------|
| pfSense | 防火墙、VPN、DNS 过滤 | - |
| MikroTik | 三层路由、VLAN 划分 | - |
| Wazuh SIEM | 日志收集、告警、合规 | Management |
| Prometheus | 指标收集 | Monitoring |
| Grafana | 可视化仪表板 | Monitoring |
| ELK Stack | 日志存储与搜索 | Server |
| AdGuard Home | DNS 过滤、广告拦截 | Management |
## VLAN 结构
| VLAN ID | 名称 | 子网 | 访问权限 |
|---------|------|--------|--------|
| 10 | Management | 10.0.10.0/24 | 仅限管理员 |
| 20 | Server | 10.0.20.0/24 | 内部服务 |
| 30 | IoT | 10.0.30.0/24 | 隔离 |
| 40 | Guest | 10.0.40.0/24 | 仅限互联网 |
| 50 | VoIP | 10.0.50.0/24 | 语音流量 |
## 快速开始
```
git clone https://github.com/vtino17/network-security-lab.git
cd network-security-lab
# 部署监控栈
cd docker && docker compose up -d
# 配置 MikroTik (通过 WinBox/CLI 导入)
# 查看 mikrotik/ 目录获取配置脚本
```
## 目录结构
```
network-security-lab/
topology/ Network diagrams and IPAM
mikrotik/ RouterOS configuration scripts
pfsense/ pfSense firewall rules and XML backups
wazuh/ Wazuh SIEM agent configs and custom decoders
monitoring/ Prometheus targets and Grafana dashboards
endpoints/ Windows and Linux hardening scripts
docs/ Architecture documentation and runbooks
scripts/ Automation and deployment scripts
docker/ Docker Compose stacks for lab services
tests/ Network connectivity and security validation
ansible/ Ansible playbooks for configuration management
```
## 要求
- 虚拟化：Proxmox VE、VMware ESXi 或 VirtualBox
- 防火墙：pfSense 2.7+ 或 OPNsense
- 路由器：MikroTik RouterOS 7.x (CHR 或物理机)
- SIEM：Wazuh 4.7+
- 监控：Prometheus + Grafana
- 自动化：Ansible 9+
## License
MIT
标签：pfSense, Wazuh, 系统提示词, 网络安全, 网络架构, 自定义请求头, 请求拦截, 隐私保护