On the more experimental side, I will soon have a Dell Optiplex Micro with Proxmox installed that I plan to use for a cyber security sandbox environment. I want to be able to collect information, monitor all of these machines, and ensure that I am experimenting in a secure and responsible way.

Prerequisites

Before starting, you must have an .iso file for Ubuntu Server or whatever OS you decide to use. You can download Ubuntu Server OS here: (https://ubuntu.com/download/server).

My Macbook has an M2 chip, which requires an ISO that is ARM64. Download here: (https://cdimage.ubuntu.com/ubuntu/releases/24.04/release/) Then select ubuntu-24.04.4-live-server-arm64.iso

1. .iso file
2. Virtualization software - I’m using UTM. I hear it plays well on MacOS devices and I’ve already tried VirtualBox in the past and found the UX to be janky. Download UTM here: (https://mac.getutm.app/)
3. 8GB RAM, 50GB Storage, 4vCPU (Official Wazuh recommendation for 1-25 agents and 90 days of storage)

Setting up your first Virtual Machine in UTM

1. Create new virtual machine
2. Virtualize
3. Linux
4. Hardware: Memory: 8192 MiB CPU Cores: 4 Enable display output: Checked Enable hardware OpenGL acceleration: Unchecked
5. Linux: Use Apple Virtualization: Unchecked Boot Image Type: Boot form ISO image Browse -> Select .iso
6. Storage: 50 GiB
7. Shared Directory: Don’t select anything -> Continue
8. Summary: Select a name for the VM -> Save

Start up the VM and go through the initial Ubuntu installation process, selecting defaults until the Network Configuration step.

Network Configuration

On the Network Configuration step, use the default IP address range. This is UTMs shared network, which create its own private NAT subnet that exists only inside this Macbook. VM traffic goes out through the Mac, so the home network never sees the VM directly.

You can switch to bridged mode so that the VM gets a 10.0.x.x address from the home DHCP server. This would allow me to put the VM in a VLAN and get metrics, logs, etc. from devices other than my Macbook this VM is running on.

For now, I am going to continue with the installation and setting up Wazuh before I move into Bridged mode. One thing at a time.

Use the default configurations for the following steps, then enter the Profile Configuration. This is where you create your first user, assign a password to it, and create your server name.

SSH Configuration

Check the “Install OpenSSH server” option. This will allow you to connect to the VM from the Mac terminal instead of working in the UTM window. Skip importing an SSH key. Password authentication is fine for now and adding the SSH key later and disabling password authentication is a good hardening exercise to document.

Skip adding additional packages on the following screen.

When the installation completes, select the “Reboot Now” option.

Installing Wazuh

Since this is an all-in-one installation (i.e. dashboard, server, and indexer on one machine) I am using the Wazuh quickstart guide (https://documentation.wazuh.com/current/quickstart.html).

After running the setup script and at the end of its output, it prints the login credentials for your initial login into the Wazuh dashboard.

Once logged into the dashboard, it’s time to add agents for your Wazuh instance to monitor. From the sidebar, select Agent Management -> Summary -> Deploy new agent to get started adding the first agent. It will ask you to select the OS, Wazuh web server IP address, agent name that you create, and the group. Based on these responses, a command is generated for you to download and install, then run the agent. Copy and run each of those commands on your agent.

Once run, the agent should pop up after ~5 minutes and you have your first device to monitor in the new SIEM!

This page is a living reference and inventory of my homelab setup - its current state and future work. I expect to periodically update it as changes are made to the homelab environment.

Purpose

This homelab grew out of my experience taking down my home network experimenting with Pihole. I needed a way to segment my network and have a sandbox environment where misconfigurations were self-contained and other people and devices would not be affected. It has since evolved as a way to learn about networking, self-host applications and services, repurpose old hardware, and explore networking, security, and infrastructure concepts without running up an AWS bill.

Architecture

flowchart TD
    wan[WAN]

    subgraph mgmt["Management VLAN (1)"]
        cgu{{Cloud Gateway Ultra <br/> Router · Firewall · IPS}}
        switch[[USW-Lite-8-PoE]]
        ap1[[U6+ AP]]
        ap2[[U6 Lite AP]]
    end

    subgraph trustedvlan["Trusted VLAN (10)"]
        printer[Printer]
        iot[IoT Devices x10]
        gaming[Gaming Consoles x2]
        mobile[Mobile Devices x4]
        laptops[Laptops x3]
        ha[Home Assistant Pi]
        hue[Hue Bridge]
    end

    subgraph iotvlan["IoT VLAN (20)"]
        iotempty[Unused]
    end

    subgraph guestvlan["Guest VLAN (30)"]
        guestempty[Unused]
    end

    subgraph homelabvlan["Homelab VLAN (40)"]
        air[Media Server]
        pro[App Server]
    end

    wan --> cgu
    cgu --> switch
    switch --> ap1
    switch --> hue
    switch --> ha
    switch --> air
    ap1 --- |Mesh Uplink| ap2
    ap1 --> pro
    ap1 --> printer
    ap1 --> iot
    ap1 --> gaming
    ap1 --> mobile
    ap1 --> laptops
    ap2 --> iot
    ap2 --> mobile
    ap2 --> laptops

Network Overview

VLAN Scheme

• Management (1) - network devices (i.e. gateway, switches, access points, etc.)
• Trusted (10) - personal devices, consoles, and IoT (planned migration to IoT VLAN)
• IoT (20) - provisioned, migration planned
• Guest (30) - provisioned, unused
• Homelab (40) - servers, sandboxes

Segmentation

• VLANs designed to be isolated from each other
• Inter-VLAN ALLOW from the network device list (tablet, Roku stick, Roku TV) which contains the devices running the Jellyfin client application (trusted) --> media server (homelab). Allow established/related return traffic
• IPv6 not configured

Networking Hardware

• Gateway - UniFi Cloud Gateway Ultra
• Switch - USW-Lite-8-PoE
• Access points - U6+ & U6 Lite

24/7 Servers

Raspberry Pi 4 - running Home Assistant OS. Currently supporting lighting automation with Phillips Hue bulbs, Hue motion sensor, an Aqara presence sensor communicating over Zigbee, and Alexa speakers.

2017 MacBook Air - Ubuntu Server OS. Running Jellyfin media server.

2018 MacBook Pro - Ubuntu Server OS. Running self-hosted todo list app (PWA, API, DB)

Remote Access

Tailscale provides an encrypted tunnel to communicate with specific devices on the network securely. At present, there are no access control lists configured to prevent any devices on the tailnet from communicating with each other. The devices currently on my tailnet are:

• Phone
• Home Assistant
• MacBook Air
• MacBook Pro
• Daily laptop

Using Tailscale allows me to access Home Assistant from my phone and laptop while I am away securely. Without access control lists, the devices running services are able to talk to my Home Assistant instance, which is not ideal and is referenced in the future work section.

Security

IPS - block all Tor/Tor-associated traffic. In reviewing logs, I noticed a significant amount of traffic originating from Tor-associated IP addresses to two devices on the homelab VLAN. Until I am able to identify and investigate further, I’ve configured the IPS to block all Tor traffic and traffic from Tor-associated IP addresses.

DHCP guarding - enabled on all VLANs to prevent rogue or unauthorized DHCP servers on the network.

Roadmap

There’s still much to be done to harden the network. This document will be updated as changes are made. Future work is as follows:

• Tailscale access control lists - not all devices on the tailnet need to be able to communicate with each other on all ports. Access control lists need to be configured to enforce principle of least privilege
• Migrate IoT devices to IoT VLAN (20) - self explanatory. IoT devices with weak or opaque security controls should live on their own VLAN. Access and functionality needs to be configured to balance security and functionality so features like AirPlay and communication with smart speakers are possible.
• Plan and configure guest network - the guest network is currently unused. I need to figure out a method of adding an authentication/approval layer to the trusted VLAN and a method for visitors to seamlessly log on to the WiFi.
• Migrate Jellyfin server - to dedicated device and more appropriate VLAN to avoid poking holes in what is intended to be a completely isolated VLAN (40)
• Dedicated management VLAN - instead of using the default UniFi VLAN, move the management VLAN and the UniFi network devices to a dedicated VLAN where I have full control over the configuration
• Migrate U6 Lite from uplink to wired connection
• Configure honeypot - future project. I’m curious to explore what kinds of activity a honeypot would get
• Log forwarding to Wazuh - in the interest of building industry-relevant skills and increasing visibility into network activity