Skip to content

Home lab

A small company, rebuilt at home

I'm building a small company network at home to train as a SOC analyst. This lab lets me learn through hands-on practice, analyse security events and document my progress.

Rear view of the homelab: GL.iNet router, Netgear switch and two Lenovo mini PCs connected via Ethernet
The lab hardware and its network cabling — October 2026.

Lab status

As of

Two operational hosts, an Active Directory domain and a single Wazuh agent: DC01. A first AD account creation has been found in the SIEM.

Operational

  • pve1 and pve2: Proxmox VE 9.2 on Samsung 512 GB NVMe, ext4 and LVM-thin. pfSense handles routing and inter-VLAN filtering.
  • DC01: operational Windows Server 2025, AD DS and DNS. Domain ad.lab.internal, OUs, fictional accounts and security policies configured.
  • Wazuh: Manager, Indexer and Dashboard running; DC01 agent (001) active. Windows event 4720 observed in Threat Hunting.
  • pfSense/Wazuh backups: Sundays at 01:00, snapshot, ZSTD, retention of 4. Separate SATA disk in the same physical host: not an external copy.

In preparation

  • Check and clean up the soc.wazuh test account; schedule DC01 backups.
  • Prepare Windows 11 on VLAN 30 and its domain join, with the necessary inter-VLAN rules.
  • Prepare workstation GPOs, Sysmon and the Wazuh agent; Windows 11 event collection remains to be validated.

Planned

  • GeeekPi DeskPi RackMate T1 Plus 10-inch 8U mini rack to house the equipment; not yet installed.
  • Suricata for network detection and TheHive for incident management.
  • Linux server in the DMZ, attack workstation and detection scenarios.
  • Windows and network forensics, then a local SOC assistant to explore as resources allow.

Not yet deployed or tested in this infrastructure.

Next step — Windows workstation and consolidation

Clean up the test account and plan DC01 backups, then join a Windows 11 workstation to the domain. Sysmon, the Wazuh agent and workstation GPOs will extend the collection already validated on the domain controller.

Read the homelab build journal →

The intended workflow

The infrastructure is taking shape progressively to support this SOC analysis workflow.

  1. 01

    Build the company

    Two hypervisors, pfSense and the ad.lab.internal domain are operational. The Windows 11 employee workstation still needs deployment and domain joining.

  2. 02

    Monitor it

    DC01 is the only active Wazuh agent. Security log collection is validated by event 4720; Sysmon on Windows 11 will follow.

  3. 03

    Attack it

    Once event collection is validated, I plan controlled exercises from the ATTACK VLAN, followed by scenarios involving the DMZ.

  4. 04

    Investigate and report

    First exercise: classify an authorised AD account creation without confusing it with a compromise. Other training write-ups are available separately.

    Read the write-ups

Network

The Beryl separates the lab from the home network. GS308E ports 2 and 3 carry VLANs to pve1 and pve2 via VLAN-aware vmbr0. pfSense handles routing and filtering; DC01 → Wazuh is validated on TCP 1514–1515. This does not validate every inter-VLAN flow: AD access for the future workstation remains to be defined, without opening management interfaces to all VLANs.

  • VLAN 1

    Admin

    192.168.8.0/24

    Router, switch, Proxmox, admin laptop

  • VLAN 20

    Servers

    10.0.20.0/24

    DC01 · 10.0.20.10 · Windows Server 2025, operational AD DS and DNS

  • VLAN 30

    Clients

    10.0.30.0/24

    Planned: Windows 11, Sysmon and Wazuh agent

  • VLAN 40

    Attack

    10.0.40.0/24

    Planned: attack workstation and controlled exercises

  • VLAN 50

    SOC

    10.0.50.0/24

    Wazuh · 10.0.50.10 · 1 active agent (DC01) · TheHive planned

  • VLAN 60

    DMZ

    10.0.60.0/24

    Planned: Linux server and exposed services for exercises

Planned rack layout

Planned

Planned 10-inch 8U mini rack to house the lab; not yet installed

  1. GL.iNet Beryl AX
  2. Netgear GS308E
  3. ThinkCentre M920q
  4. ThinkCentre M910q
GeeekPi DeskPi RackMate T1 Plus · 10-inch · 8U

Hardware

  • GL.iNet Beryl AX GL-MT3000

    Operational

    Isolation router between the home network and the lab, serves the admin network

    Wi-Fi
    Wi-Fi 6 (AX3000)
    WAN
    1 × 2.5 GbE
    LAN
    1 × 1 GbE
    OS
    OpenWrt + LuCI

  • Netgear GS308E v4

    Operational

    Managed switch, 802.1Q trunks carrying the lab VLANs to both Proxmox nodes

    Ports
    8 × 1 GbE
    VLAN
    802.1Q (20, 30, 40, 50, 60)
    Mirroring
    yes

  • ThinkCentre M920q

    Operational

    pve2 (192.168.8.11), hosts pfSense CE 2.9.0 (VM 101, WAN 192.168.8.20) and Wazuh (VM 102, 10.0.50.10), collecting events from DC01

    CPU
    Intel Core i5-8500T (6 cores)
    RAM
    32 GB DDR4 (2 × 16 GB)
    System / VMs
    Samsung PM981a 512 GB NVMe, ext4 + LVM-thin
    Backups
    SHECDO 512 GB SATA SSD, ext4
    Hypervisor
    Proxmox VE 9.2
    Network
    vmbr0 VLAN aware, switch port 3 (trunk)

  • ThinkCentre M910q

    Operational

    pve1 (192.168.8.10), hosts DC01 (VM 200, 10.0.20.10), Windows Server 2025 with Active Directory, DNS and the lab's only Wazuh agent

    RAM
    16 GB
    System / VMs
    Samsung PM981a 512 GB NVMe, ext4 + LVM-thin
    Hypervisor
    Proxmox VE 9.2
    Network
    vmbr0 VLAN aware, switch port 2 (trunk)

Outside the rack

  • Attacker

    ThinkPad X230

    Planned

    Attacker workstation on the ATTACK VLAN, kept outside the rack

    OS
    Kali Linux / Parrot OS
    Network
    VLAN 40 (ATTACK)

Documentation