Segmented Cybersecurity Homelab

This series documents my cybersecurity homelab on a single Proxmox node. I use it to learn networking, Windows identity, SIEM telemetry, detection work, attack simulation, honeypots, malware-analysis isolation, and automation.

The goal is not to build many random virtual machines. The goal is to build a small but realistic lab where each network has a clear job, and each path between networks can be explained.

Logical topology — Tailscale remote access in front of Proxmox + pfSense, each function in its own VLAN (SIEM, DEFENCE, CONTAINER, PENTEST, HONEYPOT, CLIENT, ISOLATED). Click to enlarge.

Series Map

Part	Focus
1	Proxmox, pfSense, and the first internal bridge
2	Alpine jumpbox and safe access to pfSense
3	VLANs, gateways, and early DHCP
4	Docker, Portainer, n8n, and macvlan
5	Kali and Metasploitable in the pentest segment
6	Wazuh SIEM foundation and first log sources
7	Snort IDS, T-Pot, and honeypot telemetry
8	Tailscale remote access behind CGNAT
9	Isolated malware-analysis segment
10	Active Directory, DNS, DHCP, and domain join
11	Final pfSense firewall rules and segmentation hardening

VLANs

VLAN	Subnet	Purpose
LAN	`10.10.1.0/24`	first access, jumpbox, and emergency management
10	`10.10.10.0/24`	SIEM and monitoring systems
20	`10.10.20.0/24`	defence services: Active Directory, DNS, and DHCP
30	`10.10.30.0/24`	Docker host, Portainer, automation, and containers
40	`10.10.40.0/24`	Kali and intentionally vulnerable targets
50	`10.10.50.0/24`	honeypots and attack telemetry
60	`10.10.60.0/24`	Windows clients and endpoint telemetry
99	`10.10.99.0/24`	isolated malware-analysis machines

Homelab Part 11: Final pfSense Firewall Rules and Segmentation Hardening

In Part 10, I added the Windows identity layer: Active Directory, DNS, DHCP, and a domain-joined client. In this part, I turn the lab from “everything can reach everything while I build” into an explicit firewall policy. The goal is not to make the rules fancy. The goal is to make every allowed path explainable. What I Built I replaced the temporary build-phase allow rules with a segmented pfSense policy: Default posture: deny by default Management: Tailscale + break-glass LAN/WAN access Jumpbox: Alpine SSH path into Kali Client VLAN: AD, DNS, Wazuh, Windows Update only Container VLAN: Docker host + n8n explicit egress only Honeypot VLAN: Wazuh telemetry only Pentest VLAN: no internet egress Isolated VLAN: no ingress, no egress ‹ › ...

Homelab Part 10: Active Directory, DNS, DHCP, and Domain Join

In Part 9, I built the malware-analysis segment. In this part, I add the Windows identity layer: Active Directory, DNS, DHCP, and the first domain-joined client. This is where the lab becomes useful for Windows telemetry, Sysmon, Group Policy, domain logons, Atomic Red Team tests, and later Wazuh detection work. What I Built Server: Windows Server 2022 Desktop Experience VM name: prod-winserver VLAN: 20 / DEFENCE IP: 10.10.20.20/24 Gateway: 10.10.20.1 Domain: ad.plumy.lab NetBIOS: AD Roles: AD DS, DNS, DHCP Client VLAN: 60 / CLIENT Client test: domain join and ad\plumy login Telemetry: Wazuh agent on DC and client ‹ › ...

Homelab Part 9: Malware Analysis Segment with FLARE-VM and REMnux

In Part 8, I solved remote access with Tailscale. In this part, I build the malware-analysis segment. This segment has a different philosophy from the rest of the lab. I do not want broad monitoring or domain integration here. I want controlled detonation, local observation, fake internet, and clean snapshots. What I Built Segment: isolated malware-analysis Network: vmbr99 / VLAN 99 design FLARE-VM: 10.10.99.20 REMnux: 10.10.99.10 Internet: no final direct path SIEM agent: no Status: FLARE installed, REMnux imported and booted, INetSim validation pending ‹ › ...

Homelab Part 8: Tailscale Remote Access Behind CGNAT

In Part 7, I added Snort and T-Pot telemetry. Then a practical problem changed the order of the project: I needed to work remotely while the lab stayed at home. I did not want to expose pfSense management to the public internet. Tailscale became the clean remote access layer. What I Built pfSense: Tailscale subnet router Advertised: 10.10.0.0/16 Clients: Mac and phone Recovery: Tailscale also installed directly on Proxmox Inbound ports: none exposed to the internet ‹ › ...

Homelab Part 7: Snort IDS and T-Pot Honeypot Telemetry

In Part 6, Wazuh started collecting Docker and pfSense logs. In this part, I add detection and deception: Snort on pfSense and T-Pot in the HONEYPOT VLAN. The goal is to generate useful security telemetry, not just run tools. Snort alerts need to reach Wazuh, T-Pot attack logs need to be parsed, and I need to understand why dashboards can look empty even when events exist. What I Built Snort: pfSense package, IDS mode Interfaces: WAN and LAN Rules: Community + focused ET Open categories Honeypot: T-Pot in VLAN 50 Telemetry: T-Pot Suricata eve.json -> Wazuh agent Test source: Kali in VLAN 40 ‹ › ...

Homelab Part 6: Wazuh SIEM Foundation

In Part 5, I added Kali and Metasploitable. In this part, I add the first visibility layer: Wazuh as the lab SIEM. The goal is to centralize security telemetry without trying to monitor everything at once. I start with the Wazuh server, a Docker host agent, Docker event collection, and pfSense syslog forwarding. What I Built Wazuh VM: 10.10.10.99 Segment: SIEM / VLAN 10 RAM: 8 GB CPU: 4 vCPU Disk: 128 GB Agent target: Docker host at 10.10.30.100 Syslog source: pfSense ‹ › ...

Homelab Part 5: Kali and Metasploitable Target Access

In Part 4, I created the Docker platform. In this part, I add the first classic offensive-security pair: Kali as the attacker and Metasploitable as the intentionally vulnerable target. Both machines live in the PENTEST VLAN. This keeps practice traffic away from the rest of the lab until I deliberately allow a path through pfSense. What I Built Segment: PENTEST VLAN: 40 Gateway: 10.10.40.1 Kali IP: 10.10.40.102 Metasploitable: 10.10.40.100 ‹ › ...

Homelab Part 4: Docker Host, Portainer, and Macvlan

In Part 3, I created the VLAN structure. In this part, I build the container platform inside the CONTAINER VLAN. The goal is not only to run Docker. I want important containers to have real lab IP addresses. That way, pfSense rules and Wazuh events can point to the real service, not only to the Docker host. What I Built VM name: prod-docker VM ID: 103 OS: Ubuntu Server 24.04 VLAN: 30 / CONTAINER Host IP: 10.10.30.100 Docker UI: Portainer CE Macvlan net: 10.10.30.0/26 n8n IP: 10.10.30.10 ‹ › ...

Homelab Part 3: VLAN Segmentation and Initial DHCP

In Part 2, the Alpine jumpbox gave me a stable path into pfSense. In this part, I turn the flat internal LAN into a segmented lab. The goal is to create the VLAN interfaces, give each segment a gateway IP, enable temporary DHCP where it helps installation, and leave the final firewall policy for a dedicated firewall-rules post. What I Built Parent interface: vtnet1 VLAN 10: SIEM VLAN 20: DEFENCE VLAN 30: CONTAINER VLAN 40: PENTEST VLAN 50: HONEYPOT VLAN 60: CLIENT VLAN 99: ISOLATED Current addressing: ...

Homelab Part 2: Alpine Jumpbox and pfSense Access

In Part 1, pfSense booted with a WAN side and a LAN side. In this part, I add the first internal Linux VM: a small Alpine jumpbox on the pfSense LAN. This jumpbox becomes my first stable door into the lab. I use it for SSH, local forwarding, package installs, and later access to internal services without exposing those services directly. What I Built VM name: prod-alpine VM ID: 102 OS: Alpine Linux Network: vmbr1 IP: 10.10.1.50/24 Gateway: 10.10.1.1 Role: jumpbox / bastion ‹ › ...

Homelab Part 1: Proxmox and pfSense Foundation

This is the first layer of the lab. I start with one Proxmox node, one internal VLAN-aware bridge, and pfSense as the router and firewall between the outside network and the future lab networks. I keep the goal small on purpose. I do not install services yet. Before I add Windows, Docker, Wazuh, Kali, honeypots, or malware-analysis machines, I want the network base to be correct. What I Built Physical host: homelab Hypervisor: Proxmox VE Firewall VM: prod-firewall WAN bridge: vmbr0 -> home LAN / upstream router LAN bridge: vmbr1 -> internal lab bridge, VLAN-aware, no physical uplink pfSense WAN: vtnet0 -> 192.168.1.87/24 pfSense LAN: vtnet1 -> 10.10.1.1/24 ‹ › ...

Series Map#

VLANs#

Series Map

VLANs