A hands-on implementation of a Secure Access Service Edge (SASE) security platform built from scratch using open-source tools. This project simulates a real enterprise network with multiple security layers including firewall, VPN, proxy, CASB, ZTNA, and SIEM — all running on Docker and VirtualBox.

MS Computer Networks semester project | Built for learning, portfolio, and real-world relevance.

[ Remote Users / Internet ]
         |
   [ WireGuard VPN ]
         |
   [ pfSense Firewall ]
         |
   [ Suricata IDS/IPS ]
         |
   [ Squid Proxy + CASB Rules ]
         |
   [ Keycloak IdP + OPA (ZTNA) ]
         |
   [ Internal Resources: DMZ / App / DB ]
         |
   [ ELK Stack - SIEM + Kibana Dashboard ]

SASEforge/
├── README.md
├── architecture/
│   └── architecture.svg
├── phase1-network/
│   └── docker-compose.yml
├── phase2-perimeter/
│   ├── wireguard/
│   └── suricata/
├── phase3-proxy-casb/
│   └── squid/
├── phase4-identity/
│   ├── keycloak/
│   └── opa-policies/
├── phase5-siem/
│   └── elk/
└── docs/
    └── threat-model.md

• Phase 0 - GitHub repo setup
• Phase 1 - Network foundation (Docker + VLANs)
• Phase 2 - Perimeter security (pfSense + WireGuard + Suricata)
• Phase 3 - Proxy and CASB (Squid + SSL inspection)
• Phase 4 - Identity and ZTNA (Keycloak + OPA)
• Phase 5 - SIEM and attack simulation (ELK + Kibana)
• Phase 6 - Documentation and demo video

Tools: pfSense, WireGuard, Suricata, Squid, mitmproxy, Keycloak, Open Policy Agent, Elasticsearch, Logstash, Kibana

Platform: macOS, Docker, VirtualBox

Threats are mapped to the MITRE ATT&CK framework. See docs/threat-model.md for full details.

Key attack scenarios simulated:

• Port scanning and reconnaissance (T1046)
• Brute force login attempts (T1110)
• Unauthorized cloud app access (T1567)
• Lateral movement across VLANs (T1021)

• macOS with Docker Desktop installed
• VirtualBox installed
• Git

git clone https://github.com/cybergirlApurva/SASEforge.git
cd SASEforge

Each phase folder contains its own setup instructions. Start with phase1-network/.

This project demonstrates hands-on implementation of every major SASE component in a working lab environment.

Apurva | MS Computer Networks
GitHub

MIT License