Home Lab

Break It Until It Works.

A build log of a virtualized network security lab, written up as it happened. Most of it took more than one attempt to get right. Every entry below is what actually broke, why, and how it got fixed.

Contents

1. Build Log 01

   Getting Hardware and Installing Proxmox

   Before any of the technical work could start, I had to figure out what machine would actually run this lab, then turn it into a bare-metal Proxmox host. This entry covers both: the hardware search and the install itse...

2. Build Log 02

   pfSense and Wazuh

   With Proxmox actually running, it was time to build the two things everything else in this lab depends on: a firewall/router (pfSense) and a SIEM to watch what that firewall sees (Wazuh). Before pfSense could even go...

3. Build Log 03

   Building the Attack Surface

   With the network and the SIEM in place, next came the machines that would actually give me something to attack and something to watch. Two tracks here: vulnerable web apps running as Docker containers for practice on...

4. Build Log 04

   Segmenting and Proving the Pipeline

   I sat down ready to just run an attack, Kali against Metasploitable, and watch pfSense and Wazuh catch it. Then I actually looked at the network layout and realized the attack I was planning couldn't produce anything...

5. Build Log 05

   Active Directory

   The last of the four core pieces of this build: a real Windows Server domain controller, joined into the lab the same way it would be in any actual enterprise environment. Compared to everything else in this build, th...

6. Build Log 06

   Wazuh Agents and The Real Attack

   Everything I'd caught so far, the vsftpd exploit and the VLAN-crossing traffic underneath it, I'd caught at the network layer. pfSense sees packets crossing a firewall boundary. It has no idea what's actually happenin...