A segmented enterprise network designed to shift the defensive posture from reactive to proactive: five VLANs, redundant firewalls, encrypted site-to-site tunnels, and a supervised NOC on top. 5-VLAN segmentation (DMZ, Management/NOC, Staff, HR, IT) behind an HA pfSense firewall pair. Site-to-site OpenVPN tunnels linking HQ and branch office, over Core/Distribution/Access switching layers. Zabbix NOC dashboard supervising 12+ hosts, with Suricata IDS feeding an ELK correlation stack.