Building My Home Lab: Network Segmentation & Monitoring

The Vision

As an IT professional transitioning from supply chain operations, I needed a comprehensive home lab to practice enterprise-level networking, security, and automation concepts. This lab needed to simulate real business environments while staying within a reasonable budget.

Lab Architecture Overview

Internet ←→ [pfSense Firewall] ←→ [Managed Switch] ←→ [Lab Network]
                    ↓                      ↓
              [DMZ VLAN]            [Internal VLANs]
                    ↓                      ↓
            [Web Services]     [Domain Controller, Proxmox, etc.]

Hardware Foundation

Network Segmentation Strategy

VLAN Design

# VLAN Configuration
VLAN 10: Management (192.168.10.0/24)    # Infrastructure access
VLAN 20: Lab Servers (192.168.20.0/24)   # VMs and containers
VLAN 30: DMZ (192.168.30.0/24)           # Public-facing services
VLAN 40: IoT (192.168.40.0/24)           # Smart home devices
VLAN 50: Guest (192.168.50.0/24)         # Visitor access

Firewall Rules Implementation

# pfSense Rules Example
# Block inter-VLAN communication by default
pass out on LAN from LAN:network to !LAN:network keep state
block in on LAN from !LAN:network to LAN:network

# Allow specific services
pass in on IoT_VLAN proto tcp from IoT:network to LAB:192.168.20.100 port 53
pass in on GUEST_VLAN proto tcp from GUEST:network to any port { 80 443 53 }

Virtual Infrastructure

Proxmox VE Setup

Running multiple environments on a single hypervisor:

# VM Allocation
├── Domain Controller (Windows Server 2022) - 4GB RAM
├── Security Tools VM (Kali Linux) - 8GB RAM
├── SIEM Server (Ubuntu + ELK Stack) - 8GB RAM
├── Development Environment (Ubuntu) - 6GB RAM
└── Vulnerable VMs (Metasploitable, DVWA) - 4GB RAM

Container Services

# Docker Compose for monitoring stack
version: '3.8'
services:
  prometheus:
    image: prom/prometheus
    ports:
      - "9090:9090"
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml
  
  grafana:
    image: grafana/grafana
    ports:
      - "3000:3000"
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=admin123

Monitoring and Alerting

Key Dashboards Created

Real-World Learning Outcomes

Skills Developed

Cost-Benefit Analysis

Lessons Learned

Future Enhancements

Essential Tools & Resources