⏳ (15 minutes)

Welcome to the Virtual OT Segmentation Lab!

<aside> <img src="/icons/chemistry_blue.svg" alt="/icons/chemistry_blue.svg" width="40px" />

Check the Quick Start Guide first! If you have VMware already thats all you need.

</aside>

Installing VMware

Quick Start

Networking Details

We will be using 3 virtual machines and a number of Docker containers within this lab which you can see the full networking configurations at LINK

<aside> <img src="/icons/conceal_pink.svg" alt="/icons/conceal_pink.svg" width="40px" />

Dirty Secrets for this Lab - we cheat at networking!

• Internet access uses your VMware network and host to bypass the lab environment for convenience. Internet does NOT transit the firewall.
• DMZ network is actually on your Site VM, we just use macvlan and fancy routing to make it work so we can model those networks.
• WAN interface on the firewall is actually not used at all. OPNsense would not allow provisioning without it, but it is unused in this lab. </aside>

Quick Start Guide

The quickest way to get going is with the Quick Start Guide, but once you get through that, come back here and we will walk you through completing your setup and introducing you to the lab you will be using for the remainder of this workshop.

Default Workspace

The Site VM is our primary workstation and control plane: it’s where you will access many of our tools, configure the firewall, run Docker/Compose to start and stop host containers, manage Git/config files you’ll edit during exercises. It sits on the Site subnet (10.30.0.0/24) with routed access to the OT DMZ and Cell (10.40.0.0/24), so you can browse to UIs (OPNsense, Grafana, HMI), SSH to devices, and capture traffic without leaving one box.

We preinstall common tooling—curl, nmap, tcpdump/Wireshark, jq, Python/Go, make—plus credentials and env vars for lab automation, making the Site VM the stable, resettable place to run tests, observe logs/metrics, tweak configs, and verify segmentation and IDS/IPS changes end-to-end.