Homelab — Segmented Network Security Environment

Hypervisor host, firewall appliance, managed switch, patch panel, and UPS, racked and cabled. Everything routes through a patch panel rather than running cables straight from each device to the switch — color-coded per VLAN, which paid off the first time a cable got plugged into the wrong physical port.

The hypervisor running every VM in the lab: DNS, monitoring, the jump box, and an isolated attack range. The host itself lives on the Management VLAN only — never on Lab — so a compromised lab VM has no path back to the hypervisor running everything else.

The firewall and router. Every VLAN's traffic passes through here; nothing crosses between segments unless a rule explicitly allows it. Rules are evaluated top to bottom, default-deny — anything not explicitly allowed is dropped silently, no exceptions.

Management, Servers, a DMZ for anything public-facing, and a fully isolated Lab network for intentionally vulnerable practice targets. All four ride the same physical cable between the firewall and the switch, 802.1Q-tagged over a single trunk port — one wire, four logically separate networks.

Centralized DNS for every VLAN, with DNSSEC and DNS-over-TLS, and full visibility into what every device is resolving. It came up with over 80,000 domains on its blocklist and started logging queries immediately — the DMZ's DNS also routes through it specifically so anything a compromised public-facing box tried to "call home" to would get logged and blocked automatically.

Inline intrusion detection/prevention, actively blocking known-bad traffic before it reaches anything internal. Running in true IPS mode (not just alert-only) with rulesets covering known botnet C2 traffic, compromised hosts, and active exploit signatures, auto-updating daily.

Running on the jump box — the one server reachable from the public internet — auto-banning brute-force attempts. Tuned tighter than the defaults: fewer failed attempts allowed before a ban, and repeat offenders get a longer ban each time, up to a hard cap.

Remote access to the whole lab over its own dedicated subnet. Can run split-tunnel (only lab traffic through the VPN, so everyday browsing stays fast) or full-tunnel (everything routed through home, so every device also gets Suricata inspection and encrypted DNS) — a genuine tradeoff, switched depending on whether speed or coverage matters more at the time.

Monitoring across every VM, plus UPS/power status. Wired up with real email alerting — a VM going down triggers an actual notification, not just a dashboard that quietly turns red while nobody's looking at it.