Full Office Network

The scenario

The office LAN (192.168.1.0/24) holds Employee PC (192.168.1.10), a DHCP Server (192.168.1.2) and a DNS Server (192.168.1.3). Edge Firewall sits between the LAN (192.168.1.1) and the DMZ (10.0.2.1). It forwards only TCP port 80, TCP port 443 and ICMP, and drops everything else. In the DMZ, Load Balancer owns the service address 10.0.2.10 and hands HTTP connections on port 80 to Web-1 (10.0.3.10) or Web-2 (10.0.3.11) on a backend network behind it. The DNS Server points intranet.office and api.office at 10.0.2.10. Employee PC is configured by hand with the values the DHCP pool would hand out: gateway 192.168.1.1 and DNS server 192.168.1.3. The DHCP Server is ready for new devices, but nothing in this lab asks it for a lease.

What you will work out

Trace a request through name resolution, a stateful firewall and a load balancer, and see what each device allows, rewrites or refuses.

Why this matters

Many office and small-company networks are some version of this: LAN services, a firewall at the edge, and servers behind a balancer. When 'the intranet is down', each device is a question: does the name resolve, does the firewall allow the port, does the balancer handle that port, and is a backend listening? A trace answers all four in one run, and reading a firewall's rules for their direction is how you check the DMZ is really one.

Running it

Full Office Network opens on a canvas, already wired and addressed. Trace a packet through it hop by hop, or run the same topology live on real Linux network namespaces. How the two modes differ.