Enterprise Security Homelab
A six-VLAN, default-deny network for a fictional regional bank: pfSense, managed switching, a Proxmox hypervisor on a trunk port, a Windows Server 2025 domain controller, Wazuh as the SIEM, and every firewall rule justified and mapped to a NIST control.
The scenario
Most homelabs are a pile of services on a flat network. This one is built and documented as the infrastructure of Biira Bank, a fictional state-chartered bank, because working to a named organisation forces the decisions a real environment forces: who needs to reach what, why a rule exists, what an auditor would ask, and what happens when something fails. Financial services was chosen deliberately. It is the sector where segmentation, least privilege, change control and evidence are least optional.
The domain is real (ad.biira.online), the segmentation is real, and the controls are tested rather than described. The sibling Enterprise IAM Lab is the same organisation’s identity estate and runs on top of this network.
Architecture
Internet enters through pfSense, which holds the .1 gateway on all six VLANs, so every packet that crosses a segment boundary is a firewall decision. A TP-Link managed switch carries the 802.1Q tags: Port 1 trunks to pfSense, Port 2 trunks to a second switch feeding the Proxmox VE hypervisor, and Ports 3 to 8 are single-VLAN access ports for physical hosts.
| VLAN | Zone | Subnet | What lives there |
|---|---|---|---|
| 10 | Management | 192.168.10.0/24 |
pfSense, Proxmox, the Ansible controller, the admin workstation |
| 20 | BlueTeam | 192.168.20.0/24 |
SIEM01: Wazuh manager, indexer and dashboard |
| 30 | RedTeam | 192.168.30.0/24 |
KALI01, the attack host, as a Proxmox VM |
| 40 | DevOps | 192.168.40.0/24 |
HashiCorp Vault host (staged) |
| 50 | EnterpriseLAN | 192.168.50.0/24 |
DC01, Windows Server 2025 domain controller |
| 60 | Monitoring | 192.168.60.0/24 |
Grafana and Prometheus |
Proxmox sits on a trunk port with a single VLAN-aware Linux bridge, so a VM’s network placement is one tag on its virtual NIC. Moving the hypervisor from an access port to the trunk without locking myself out is written up in Proxmox on a Trunk Port.
What is built
- Default-deny segmentation on three of the six interfaces so far (MANAGEMENT, ENTERPRISELAN, REDTEAM). Every rule in those rulesets carries a business justification and a NIST SP 800-53 control mapping in a living rule register, with a change log that records tester, rollback and validation evidence.
- Management-plane isolation, verified by before-and-after testing: VLAN 50 cannot reach the pfSense administrative interface on any address, while it keeps the DNS, NTP and internet access it legitimately needs.
- Attack-segment containment. KALI01 on VLAN 30 has no standing path to the domain controller or any other VLAN. The containment test is recorded as evidence, and the runbook is explicit about what the test does and does not prove about reachability.
- DC01, a Windows Server 2025 domain controller for
ad.biira.onlinewith AD-integrated forward and reverse DNS zones and a cleandcdiag. It is the first Wazuh agent. - SIEM01, Wazuh 4.14 on dedicated hardware after a role swap: the original SIEM host died, and the rebuild was the chance to give the Wazuh indexer the 16 GB box and move Grafana and Prometheus, which need about 2 GB, into a Proxmox guest.
- Nightly Proxmox backups to a separate physical disk, with a documented and tested restore (NIST CP-9), and SHA256 verification of every installation image before use (SI-7).
- Remote access over Tailscale with WireGuard, with its ability to bypass per-interface rules recorded as a known, risk-accepted hardening item rather than ignored.
- Cross-platform automation with Ansible: role-based playbooks, a dedicated service account, SSH ED25519 keys for Linux and WinRM for Windows.
Decisions worth explaining
Rules are written for the auditor, not the firewall. A rule that works but cannot be justified is a finding waiting to happen. The rule register in docs/13 lists the eight principles auditors check against a rulebase and applies them to every rule: purpose, owner, least privilege, control mapping, review date.
Failure is treated as design input. Two hardware failures (a NIC, then the SIEM host) are documented as incidents with a decision record, not quietly fixed. The second one produced a better topology than the original.
Naming is a control. Every machine follows <ROLE><NN> (DC01, SIEM01, ANS01, KALI01) and every screenshot follows <area>-<NN>-<subject> so evidence can be traced to the configuration it proves. That is what CIS Control 12.4 and NIST AU-3 actually ask for.
What is next
- Harden the remaining three rulesets (BlueTeam, DevOps, Monitoring), which are still permissive.
- Rebuild ANS01 and MON01 as Proxmox guests, and bring Ansible back online.
- Roll Wazuh agents out across the estate, then write custom detections and dashboards against real telemetry.
- Scope Tailscale to close hardening item H-02.
- Grow the Windows estate (a replica DC, a CA, member workstations) per the lab-expansion roadmap, so the identity lab has realistic endpoints to protect and to attack.
What it looks like when it is actually configured.
Screenshots from the build, named and captioned so each one can be traced to the configuration it proves.
