Project: build a home lab network
In short: A home lab gives you somewhere to practise safely and repeatedly. This project shows how to start small, keep the lab separated from your family network, run virtual machines on a hypervisor and document it so it becomes evidence of your skills.
Goal and requirements
The goal is a lab you can break and rebuild without affecting anyone else's internet. Good requirements:
- Isolated: lab traffic, especially security tools and test malware samples, must not reach home devices.
- Rebuildable: snapshots, backups and notes so you can reset in minutes.
- Affordable and quiet: second-hand or small hardware, low power use.
- Useful: supports the topics you are studying, such as routing, firewalls, a SIEM (security information and event management) or containers.
Design
A typical design puts a lab firewall (a VM or small box running pfSense or OPNsense) behind your home router. Its WAN side gets an address from the home network; its LAN side carries lab VLANs such as 10 for servers, 20 for clients and 66 for a deliberately isolated "dirty" network with no route out. A hypervisor such as Proxmox VE, VMware or Hyper-V hosts the VMs, and a managed switch, if you have one, carries the VLANs as trunks. Write an IP plan before you build.
| Network | Subnet | Purpose | Internet |
|---|---|---|---|
| Lab servers | 10.10.10.0/24 | Domain controller, web, SIEM | Yes, filtered |
| Lab clients | 10.10.20.0/24 | Windows and Linux desktops | Yes, filtered |
| Isolated | 10.10.66.0/24 | Vulnerable VMs, analysis | No |
| Management | 10.10.99.0/24 | Hypervisor and switch admin | Updates only |
Build plan
- Start on your laptop with VirtualBox or a free hypervisor and Packet Tracer or GNS3.
- Install a hypervisor on a mini PC or old desktop; give the management interface a fixed IP and a strong password, and turn on MFA if the hypervisor supports it.
- Create the firewall VM with two virtual NICs (network interface cards): WAN to home, LAN to the lab bridge. Default-deny from the lab to the home network.
- Add VLANs and DHCP on the firewall, then your first VMs: a Linux server and a Windows client.
- Take snapshots before every big change, and back up VM configs to another disk.
- Add services as you learn: DNS, a web server, the Wazuh SIEM lab, the minikube lab.
ip addr
ip route
ping -c 3 10.10.10.1
ping -c 3 192.168.1.1
traceroute 1.1.1.1
nmap -sn 10.10.10.0/24From a lab VM the first ping should work and the second, to the home router's LAN, should be blocked by your rule if your home network is 192.168.1.0/24. Scan only your own lab ranges.
Deliverables and how to present it
- A diagram and IP plan, kept up to date.
- A build log: what you installed, why, and problems you solved.
- Firewall rule list with the purpose of each rule.
- Short write-ups of labs you ran on it.
On a CV, keep it concrete: "Built and maintain a segmented home lab (Proxmox, OPNsense, four VLANs) used for SIEM, Active Directory and Kubernetes practice." In interviews, talk about a problem you fixed, such as a VLAN that did not pass the trunk. That shows real troubleshooting experience, which employers value highly in junior candidates.
Practice
Why put a firewall between the home network and the lab?
What is the purpose of an isolated network with no internet route?
Why take snapshots before changes?
Key takeaways
- Start small; a laptop with VMs is a real lab.
- Separate the lab from the home network with a firewall.
- Plan VLANs and IP ranges before you build.
- Use snapshots and backups so rebuilding is quick.
- Document it and describe it with outcomes on your CV.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.