This is easy, and I have done it in the past. You will need at least three guests, one for the server, one (or more if you have room) for the client, and one running pfSense. You will route the internet traffic through the pfSense guest, and use a firewall rule inside the pfSense guest to block access to your physical LAN while allowing Internet through to the guest. We'll set this up later.
For the LAN-blocking firewall rule to work, your test environment's ip address range needs to be different from your physical LAN's ip address range. For example, if your host PC's physical LAN ip range is 192.168.1.###, then you need to pick a different range for the guests' network. 192.168.any-other-valid-number.### will work, so will 10.0.33.###, etc. See
wikipedia private ip addresses for some ideas of what to pick. Just use one of the valid private ip address ranges, and make at least one of the first three numbers different than what your physical LAN is set to. For this tutorial, let's pretend your physical LAN is 192.168.1.###, and we'll pick 10.0.33.### for the test network. Both have a subnet mask of 255.255.255.0, so only the last ### number changes. Change the numbers to your numbers when you run your tests.
pfSense does not need much RAM. Their website says 512MB minimum, but I remember running it on 256. Do tests to see what pfSense will let you get by with, the load on this guest won't be really strong.
The pfSense will have two network adapters. The first adapter will be set to "Bridged" and will be connected to the "WAN" side of pfSense. Let this WAN adapter get its IP address from your physical LAN's DHCP, not static. The second adapter will be an "Internal" network. If your server guest will be handling DHCP, then turn off DHCP on the LAN side of pfSense, and set the ip address of the LAN adapter in the pfSense OS to 10.0.33.1, so it can be the gateway for the Internal LAN. (pfSense has a plug/unplug setup procedure to enable pfSense to figure out which adapter should be WAN and which should be LAN. Familiarize yourself with Virtualbox's "Devices menu > Network > Connect Network Adapter #" and the little icons in the menu so you can "plug & unplug" the correct "ethernet cables" to the pfSense guest as needed.)
Your guests will each have one network adapter, and both adapters will be attached to the same "Internal" network the pfSense LAN adapter is connected to. Internal networks are generated by the name of the network. Type a different name, you get a different Internal network. So be sure all three adapters going on your Internal network have exactly the same name. Cut & paste if you decide to call the Internal network something else besides the default 'intnet'.
Once you get your Internal network set up, you can see
pfSense firewall rule for how to set up your firewall rule. Substitute your physical LAN's ip address range for the range the rule will block. Your guests will be able to see the internet, but they will not be able to access anything on your physical LAN.
Human government is like that crazy uncle who hides a quarter in his fist behind his back, then asks you to guess which fist the quarter is in...
No matter which side you choose, Left or Right, both Sides are empty.