Proxmox

In Part 8, I solved remote access with Tailscale. In this part, I build the malware-analysis segment. This segment has a different philosophy from the rest of the lab. I do not want broad monitoring or domain integration here. I want controlled detonation, local observation, fake internet, and clean snapshots. What I Built Segment: isolated malware-analysis Network: vmbr99 / VLAN 99 design FLARE-VM: 10.10.99.20 REMnux: 10.10.99.10 Internet: no final direct path SIEM agent: no Status: FLARE installed, REMnux imported and booted, INetSim validation pending ‹ › ...

In Part 7, I added Snort and T-Pot telemetry. Then a practical problem changed the order of the project: I needed to work remotely while the lab stayed at home. I did not want to expose pfSense management to the public internet. Tailscale became the clean remote access layer. What I Built pfSense: Tailscale subnet router Advertised: 10.10.0.0/16 Clients: Mac and phone Recovery: Tailscale also installed directly on Proxmox Inbound ports: none exposed to the internet ‹ › ...

In Part 4, I created the Docker platform. In this part, I add the first classic offensive-security pair: Kali as the attacker and Metasploitable as the intentionally vulnerable target. Both machines live in the PENTEST VLAN. This keeps practice traffic away from the rest of the lab until I deliberately allow a path through pfSense. What I Built Segment: PENTEST VLAN: 40 Gateway: 10.10.40.1 Kali IP: 10.10.40.102 Metasploitable: 10.10.40.100 ‹ › ...

This is the first layer of the lab. I start with one Proxmox node, one internal VLAN-aware bridge, and pfSense as the router and firewall between the outside network and the future lab networks. I keep the goal small on purpose. I do not install services yet. Before I add Windows, Docker, Wazuh, Kali, honeypots, or malware-analysis machines, I want the network base to be correct. What I Built Physical host: homelab Hypervisor: Proxmox VE Firewall VM: prod-firewall WAN bridge: vmbr0 -> home LAN / upstream router LAN bridge: vmbr1 -> internal lab bridge, VLAN-aware, no physical uplink pfSense WAN: vtnet0 -> 192.168.1.87/24 pfSense LAN: vtnet1 -> 10.10.1.1/24 ‹ › ...