The foundation of the lab. Every service runs as a virtual machine or container so I can snapshot before a change, roll back when something breaks, and rebuild from backups on purpose to test recovery.
Home lab
A Proxmox environment where I practice enterprise administration every week: virtualization, segmented networking, DNS filtering, Windows and Linux services, media and smart-home automation.
Topology
Segmented by role · firewall policy between zones
Hypervisor
Proxmox VE
Edge
pfSense · VLAN routing · firewall rules
Directory
Windows Server · AD · DNS · DHCP · GPO
DNS filtering
Pi-hole for every VLAN
Services
Jellyfin · Home Assistant
Guests
Windows & Linux VMs · containers
Services
What each piece is for
pfSense sits between the ISP and the lab. Each VLAN gets its own interface and rule set, so IoT devices cannot reach the servers, clients cannot reach the management plane, and only explicitly allowed traffic crosses zones.
Practices
A domain controller mirrors what I administer in the Marine Corps: user and computer objects, organizational units, Group Policy baselines, DNS zones and DHCP scopes. It is where I rehearse hardening and access-control changes before doing them for real.
Practices
Every VLAN resolves through Pi-hole, which blocks ads and telemetry and gives me query logs to see what devices are actually talking to.
Practices
The services the household actually uses. Jellyfin streams the media library; Home Assistant automates lights, sensors and routines on an isolated IoT VLAN with only the ports it needs open.
Practices
Ubuntu and Debian guests for scripting, containers and security coursework, plus Windows clients joined to the domain to test policy and access changes end to end.
Practices
Lab log
Documented as it grows
Segment
VLANs for management, servers, IoT and clients with firewall policy between them.
Direct
Windows Server domain with AD, DNS, DHCP and Group Policy baselines.
Observe
Pi-hole query logs and pfSense logging to see what the network is doing.
Next
Centralized logging, a vulnerability scanner and monitoring dashboards. Details will be published here as they land.
Available for new projects
Curious about the lab?
I am happy to walk through the design decisions, the mistakes and what I would do differently.