Tailscale

In Part 10, I added the Windows identity layer: Active Directory, DNS, DHCP, and a domain-joined client. In this part, I turn the lab from “everything can reach everything while I build” into an explicit firewall policy. The goal is not to make the rules fancy. The goal is to make every allowed path explainable. What I Built I replaced the temporary build-phase allow rules with a segmented pfSense policy: Default posture: deny by default Management: Tailscale + break-glass LAN/WAN access Jumpbox: Alpine SSH path into Kali Client VLAN: AD, DNS, Wazuh, Windows Update only Container VLAN: Docker host + n8n explicit egress only Honeypot VLAN: Wazuh telemetry only Pentest VLAN: no internet egress Isolated VLAN: no ingress, no egress ‹ › ...

In Part 7, I added Snort and T-Pot telemetry. Then a practical problem changed the order of the project: I needed to work remotely while the lab stayed at home. I did not want to expose pfSense management to the public internet. Tailscale became the clean remote access layer. What I Built pfSense: Tailscale subnet router Advertised: 10.10.0.0/16 Clients: Mac and phone Recovery: Tailscale also installed directly on Proxmox Inbound ports: none exposed to the internet ‹ › ...