valerieolg/Homelab

# Homelab **Built by a cybersecurity student with 8 months of experience who wanted to learn enterprise infrastructure hands-on - not just read about it.** This lab simulates an enterprise-like network at home. It uses real hardware, real network segmentation, a functional firewall with IDS, VPN, Active Directory, and a SIEM. It is also used as a penetration testing environment against my own network. ## Hardware | Device | Role | |---|---| | HPE ProLiant DL180 Gen10 | Main server (Proxmox hypervisor) | | HP Switch 1820 24-port | Managed switch (VLAN trunking) | | TP-Link Archer A6 | Secondary router / double NAT layer | | ISP Modem | WAN uplink | ## Architecture Overview ## Network Map | Network | Subnet | Purpose | |---|---|---| | VLAN10 Management | 192.168.10.0/24 | Laptop, Proxmox access, switch management | | VLAN20 Lab | 192.168.20.0/24 | VMs, Active Directory, Wazuh, Plex | | WireGuard VPN | 10.10.10.0/24 | Remote access (iPhone + laptop) | ## Services ### Infrastructure | Service | Type | Description | |---|---|---| | Proxmox VE | Bare metal | Hypervisor running all VMs | | OPNsense | VM | Firewall, router, gateway, DHCP, DNS | | HP Switch 1820 | Physical | VLAN segmentation and trunking | ### Security & Monitoring | Service | Type | Description | |---|---|---| | Suricata IDS | OPNsense plugin | Intrusion detection on WAN, PCAP mode, alert only | | Unbound DNS | OPNsense plugin | Recursive DNS with DNSSEC, registers DHCP leases | | WireGuard VPN | OPNsense plugin | Remote access VPN, port 51820, tunnel 10.10.10.0/24 | | DuckDNS | OPNsense plugin | Dynamic DNS, auto-updates public IP on WAN change | | Monit | OPNsense plugin | Service monitoring and email alerts | | Wazuh SIEM | VM | Centralized log collection, threat detection, agents on Proxmox and DC-01 | | Active Directory | VM | homelab.local domain, DC-01, intentional misconfigs for pentest practice | ### Planned | Service | Target IP | Notes | |---|---|---| | Plex Media Server | 192.168.20.12 | After QoS tuning | | HAProxy | OPNsense | Reverse proxy after all VMs stable | | Kali Linux | 192.168.20.13 | Pentest VM | ## Security Architecture ### Defense-in-Depth Layers | Layer | Tool | Function | |---|---|---| | Perimeter | OPNsense firewall | Block all unsolicited inbound, VLAN isolation | | IDS | Suricata on WAN | Alert on known threat signatures | | DNS | Unbound + DNSSEC | Validates DNS responses, blocks cache poisoning | | Network segmentation | VLANs 10 and 20 | Management and lab traffic isolated from each other | | Remote access | WireGuard VPN | Encrypted tunnel, only UDP 51820 exposed | | SIEM | Wazuh | Centralized log analysis and threat detection | | Active Directory | DC-01 | Domain controller with intentional misconfigs for attack practice | | Monitoring | Monit + email alerts | Notifies on service failures | ### What Is Exposed to the Internet | Component | Exposed? | Protection | |---|---|---| | OPNsense WAN | Public IP visible | Firewall drops all unsolicited inbound | | WireGuard | UDP 51820 only | Encrypted, authenticated tunnel | | All internal services | No | LAN or VPN only | | Proxmox web UI | No | VLAN10 only | | Switch management | No | VLAN10 only | ## Implementation Phases | Phase | Focus | Status | |---|---|---| | 1 | Proxmox install, network config, vmbr setup | Done | | 2 | OPNsense VM, WAN/LAN/VLAN interfaces | Done | | 3 | Switch VLAN config, trunk port, laptop VLAN | Done | | 4 | Firewall rules, aliases, DHCP, Unbound DNS | Done | | 5 | Suricata IDS, DuckDNS, WireGuard VPN | Done | | 6 | Monit monitoring, scheduled rules, QoS placeholder | Done | | 7 | Wazuh SIEM VM | Done | | 8 | Active Directory VM | Done | | 9 | Plex VM, QoS tuning | Planned | | 10 | HAProxy reverse proxy | Planned | | 11 | Penetration testing lab exercises | Planned | ## Skills Demonstrated - Network segmentation with VLANs on a managed switch - Firewall design with defense-in-depth (OPNsense) - Intrusion detection deployment and ruleset configuration (Suricata) - DNS security with DNSSEC and recursive resolver (Unbound) - VPN setup with WireGuard through double NAT - Dynamic DNS configuration (DuckDNS) - Service monitoring and alerting (Monit) - Virtualization and VM management (Proxmox VE) - Active Directory and Windows Server administration - SIEM deployment and log analysis (Wazuh) - Penetration testing fundamentals (planned) ## Repository Structure ## Notable Challenges and Lessons Learned A few highlights - full list in each relevant doc: - Always configure OPNsense DHCP and firewall rules BEFORE moving the laptop port to a new VLAN on the switch or you lose all connectivity - WireGuard in OPNsense 26.1 cannot have a static IP on the tunnel interface - use IPv4 type None with dynamic gateway policy - Double NAT requires port forwards on both devices for VPN to work - Port checkers always show UDP as closed even when WireGuard is working - check handshake status in OPNsense instead - Wazuh agent version must match or be lower than the manager version - pin it explicitly ## Note on Sensitive Data Real IPs for management interfaces, DuckDNS subdomain, and VPN endpoints are not published in this repository. Network subnets are documented accurately. Host-specific addresses for infrastructure devices are redacted.