CEI-LABS // MODULE 03 — TERRAIN

Net

The network the whole range stands on: hard-segmented VLANs, participant-to-participant isolation, a DNS allowlist locked to exactly what the wargames need, and QoS that keeps 80 operators scanning without taking the range down.

80 OPERATORS·6 VLANS·DNS ALLOWLIST·PER-CLIENT QoS
VIEW THE SEGMENTS SOURCE ↗
SEC 01 / DESIGN PRINCIPLE

Net assumes the participants are the threat. Every segment is isolated by default, egress is deny-all except an explicit allowlist, and the range control plane is unreachable from the participant VLAN. The allowlist's source of truth is Wargames' required network access document — Net implements exactly that and nothing more.

SEC 02 / SEGMENT MAP

VLAN ladder

Six segments, isolated by default, routed only where a documented need exists.

10MANAGEMENT — switch, AP, and hypervisor control plane. No participant route.
20RANGE — the Engine cluster: CTFd, MultiJuicer, analyst workstations, targets.
30PARTICIPANTS — operator laptops. Client isolation on; peers are unreachable.
40STAFF — instructor and admin machines with range + management reach.
50UPSTREAM — filtered egress. Deny-all except the DNS + host allowlist.
99QUARANTINE — default drop zone for untagged and unrecognized devices.
SEC 03 / CONTROLS
CLIENT ISOLATION

Participants can reach the range on VLAN 20 but never each other — no lateral movement, no cross-team snooping on the participant segment.

DNS ALLOWLIST

Resolver answers only for hosts the wargames require. Everything else is NXDOMAIN — no arbitrary outbound name resolution.

EGRESS FIREWALL

Default-deny egress on VLAN 50. The allowlist mirrors Wargames' required-network-access document exactly.

PER-CLIENT QoS

Bandwidth is shaped per client so a single aggressive scan can't starve the range for everyone else.

SEC 04 / EVENT-DAY CHECKPOINTS

The order Net comes online before doors open.

VLANs + trunk ports provisioned on the switch
Client isolation confirmed on participant SSID
DNS allowlist loaded and resolver smoke-tested
Egress firewall reconciled against required-access doc
Per-client QoS shaping enabled
Range reachable from VLAN 30; management unreachable

Checkpoint order is the design intent; the live status of each is tracked in Event.

OTHER MODULES
MODULE 01 — RANGE PLATFORMEngine

A modular, multi-tenant cyber range on bare-metal K3s.

 MODULE 02 — COURSE OF FIREWargames

59 challenges, three tracks, one fail-closed deploy.

 MODULE 04 — THE OPERATIONEvent

A full-scale, self-hosted CTF experience — 80 operators, 59 challenges.

 MODULE 05 — LOADOUTAgent

A friendly CTF coaching AI that runs on your own laptop.