PfSense Training Project Tracker

Project Tracker for Comfac's pfSense Practical Training System implementation. This page tracks all tasks from material conversion to infrastructure deployment and course delivery.

Phase 0: Material Conversion (FUND001 → Wiki)

Convert all Netgate FUND001 training PDFs into CITWiki pages with detailed summaries. Each wiki page should include: learning objectives, key concepts, step-by-step lab instructions adapted for virtual environment, and troubleshooting tips.

Slide Decks

[ ] SEG1 — Introduction to pfSense → Training: pfSense Introduction
[ ] SEG2 — Interfaces, VIPs, and Rules → Training: Interfaces and Firewall Rules
[ ] SEG3 — NAT and VIPs → Training: NAT and Virtual IPs
[ ] SEG4 — pfSense Services → Training: pfSense Services
[ ] SEG5 — VPNs and IPsec → Training: IPsec VPN
[ ] SEG6 — OpenVPN → Training: OpenVPN
[ ] SEG7 — WireGuard → Training: WireGuard
[ ] SEG8 — Multi-WAN → Training: Multi-WAN
[ ] SEG9 — Traffic Shaping → Training: Traffic Shaping
[ ] SEG10 — High Availability → Training: High Availability
[ ] SEG11 — Other Features → Training: Monitoring and Packages

Labs

[ ] Lab 1 — Intro, Getting Started, Backup/Restore → Training Lab 1: Introduction and Backup Restore
[ ] Lab 2 — Interfaces, Firewall Rules, Aliases → Training Lab 2: Firewall Rules and Aliases
[ ] Lab 3 — Virtual IPs and NAT → Training Lab 3: NAT and Virtual IPs
[ ] Lab 4 — Services and Branch Network Setup → Training Lab 4: Services and Branch Network
[ ] Lab 5 — IPsec → Training Lab 5: IPsec VPN
[ ] Lab 6 — OpenVPN → Training Lab 6: OpenVPN
[ ] Lab 7 — WireGuard → Training Lab 7: WireGuard
[ ] Lab 8 — Multi-WAN → Training Lab 8: Multi-WAN
[ ] Lab 9 — Traffic Shaping → Training Lab 9: Traffic Shaping
[ ] Lab 10 — High Availability → Training Lab 10: High Availability

Reference Materials

[ ] the-pfsense-documentation.pdf → Summarize into Training: pfSense Complete Reference or link as external reference
[ ] WindowsTrainingSupportFiles.zip → Extract and document client software requirements (Training: Client Software Requirements)
[ ] Training Videos (4× .mkv) → Catalog timestamps and link from relevant wiki pages

Phase 1: Infrastructure Setup

Build the virtual training environment on Comfac's 200-core / 1TB RAM machine.

Host Preparation

[ ] A.1 Install Ubuntu Server LTS on 200-core host
[ ] A.2 Configure KVM/libvirt with storage pools (NVMe for images, SSD for ephemeral clones)
[ ] A.3 Set up network bridges: `br-mgmt`, `br-lan`, `br-wan`, `br-dmz`, `br-internet`
[ ] A.4 Configure VLANs for student isolation (one VLAN per student or per lab)
[ ] A.5 Install and configure Ansible controller (host or container)

Base Images

[ ] B.1 Download pfSense CE ISO and create qcow2 golden image (2 vCPU, 1 GB RAM, 8 GB disk)
[ ] B.2 Create Ubuntu Server 22.04/24.04 golden image (1 vCPU, 1 GB RAM, 10 GB disk)
[ ] B.3 Create Windows 10/11 thin client golden image (2 vCPU, 4 GB RAM, 40 GB disk) — OR decide to use Linux clients only
[ ] B.4 Create "Internet Router" golden image (Ubuntu with FRR/Quagga or simple static routes, 1 vCPU, 512 MB RAM)
[ ] B.5 Test each golden image boots and functions correctly

Automation

[ ] C.1 Write Ansible playbook: `lab1-student-env.yml` (1 pfSense + 1 client)
[ ] C.2 Write Ansible playbook: `lab2-student-env.yml` (1 pfSense + 1 client + 1 server)
[ ] C.3 Write Ansible playbook: `lab3-student-env.yml` (1 pfSense + 1 server + internet)
[ ] C.4 Write Ansible playbook: `lab4-student-env.yml` (2 pfSense + 2 clients + 1 server)
[ ] C.5 Write Ansible playbooks for Labs 5–10 (VPNs, Multi-WAN, Shaping, HA)
[ ] C.6 Write Ansible playbook: `cleanup-student-env.yml` (destroy VMs, free resources)
[ ] C.7 Write Ansible playbook: `reset-student-env.yml` (revert to snapshot/linked clone base)
[ ] C.8 Test all playbooks end-to-end with a single student ID

NoVNC Portal

[ ] D.1 Evaluate Kimchi vs Apache Guacamole vs custom NoVNC proxy
[ ] D.2 Install and configure chosen NoVNC solution
[ ] D.3 Integrate NoVNC with student authentication (LDAP, local wiki accounts, or simple token-based)
[ ] D.4 Build student dashboard: list of phases/labs, "Launch Lab" button, countdown timer
[ ] D.5 Test 5 concurrent NoVNC sessions for stability
[ ] D.6 Test 20 concurrent NoVNC sessions for performance

Phase 2: Curriculum Development

Design the student-facing training program.

Introduction Course (Most Common Use Case)

[ ] E.1 Define "Setting Up a Firewall for Yourself" scope: home office / small business
[ ] E.2 Write Module 0: Why You Need a Firewall (threats, NAT basics, basic topology)
[ ] E.3 Write Module 1: Install pfSense on Old PC or VM (hardware requirements, USB install, first boot wizard)
[ ] E.4 Write Module 2: Basic WAN + LAN Setup (DHCP, DNS, first internet connection)
[ ] E.5 Write Module 3: Essential Firewall Rules (block incoming, allow outgoing, ICMP)
[ ] E.6 Write Module 4: Port Forwarding for Common Services (game server, camera, NAS)
[ ] E.7 Write Module 5: VPN for Remote Access (WireGuard road warrior setup)
[ ] E.8 Write Module 6: Backup and Updates (config.xml backup, update schedule)
[ ] E.9 Create hands-on lab for Introduction Course (single pfSense + 1 client VM)
[ ] E.10 Record or source video walkthroughs for each module

Full FUND001 Adaptation

[ ] F.1 Map each SEG slide deck to a wiki training page with summary + key takeaways
[ ] F.2 Adapt Netgate labs from physical/virtualbox environment to KVM/Ansible environment
[ ] F.3 Update IP addressing schema for Comfac virtual lab (avoid conflicts with production)
[ ] F.4 Write pre-lab briefing pages (what you'll learn, expected outcomes)
[ ] F.5 Write post-lab review pages (common mistakes, verification steps, "show me" checklist)
[ ] F.6 Create quiz questions for each phase (5–10 questions, auto-graded if possible)

Phase 3: Pilot & Refinement

Run the training with a small group before full rollout.

Internal Pilot

[ ] G.1 Recruit 3–5 internal Comfac IT staff as pilot students
[ ] G.2 Run Phase 1 (Foundations) with pilot group — collect feedback
[ ] G.3 Run Phase 2 (NAT & Services) with pilot group — collect feedback
[ ] G.4 Run one VPN lab (IPsec or OpenVPN) with pilot group — test resource limits
[ ] G.5 Document all bugs, confusion points, and timeouts
[ ] G.6 Refine playbooks and wiki pages based on pilot feedback

Resource Tuning

[ ] H.1 Measure actual CPU/RAM/disk usage per student during pilot
[ ] H.2 Adjust VM specs if over- or under-provisioned
[ ] H.3 Test memory overcommit ratios for safe concurrency scaling
[ ] H.4 Document maximum safe concurrent student count

Phase 4: Deployment & Operations

Prepare for regular training delivery.

Student Onboarding

[ ] I.1 Create student onboarding guide (how to access portal, use NoVNC, reset lab)
[ ] I.2 Create instructor guide (how to monitor progress, assist students, grade labs)
[ ] I.3 Set up scheduling system (book lab time slots, prevent over-allocation)
[ ] I.4 Create completion certificates or badges

Monitoring & Maintenance

[ ] J.1 Set up host monitoring (Prometheus/Grafana or simple `libvirt` stats)
[ ] J.2 Configure alerts for host resource exhaustion
[ ] J.3 Schedule weekly base image updates (pfSense patches, OS updates)
[ ] J.4 Document disaster recovery (rebuild host from Ansible, restore golden images)

Quick Status Dashboard

Phase	Status	% Complete	Blockers
Phase 0: Material Conversion	🟡 In Progress	0%	Need bot/API access for bulk uploads
Phase 1: Infrastructure Setup	🔴 Not Started	0%	Need 200-core host access
Phase 2: Curriculum Development	🔴 Not Started	0%	Waiting on Phase 0 completion
Phase 3: Pilot & Refinement	🔴 Not Started	0%	Waiting on Phase 1 + 2
Phase 4: Deployment & Operations	🔴 Not Started	0%	Waiting on Phase 3

Resource Summary

Per-student minimum: 6 vCPUs, 6.5 GB RAM, 62 GB disk Per-student full lab: 10 vCPUs, 10.5 GB RAM, 110 GB disk 200-core / 1TB capacity: 20–40 concurrent students (conservative to optimized)

Next Actions (This Week):

Start converting FUND001-LIVE-SLIDE-SEG1-INTRO.pdf and FUND001-LIVE-Lab1-Intro.pdf to wiki
Confirm 200-core host specifications and OS
Evaluate Kimchi vs Guacamole for NoVNC portal