Advanced Home Lab Architecture – Part 3

Security, Automation, and Identity: From Infrastructure to Enterprise Reality

With Proxmox, VLANs, and routing in place, your lab now resembles a real enterprise network. Part 3 focuses on security enforcement, automated infrastructure, centralized logging, and identity hardening — the difference between a lab that runs and a lab that teaches you how enterprises actually operate.

Operator’s Lens: In one early lab, AD replication failed silently because VLANs weren’t enforced and logs weren’t collected. That day taught me the difference between a lab that runs and a lab that teaches real enterprise skills.

This post covers four critical domains:

pfSense CLI & operational examples
Terraform + Proxmox Infrastructure-as-Code
SOC log forwarding & observability
Active Directory lab hardening playbooks

1️⃣ pfSense CLI & Operational Insights

Operator’s Lens: Enterprise firewalls are not just GUIs. CLI familiarity saves you hours during misconfigurations or outages.

Accessing pfSense CLI

Console option: 8 → Shell
SSH: ssh admin@192.168.10.1

Interface & VLAN Verification

ifconfig
cat /conf/config.xml | grep -A3 "<interfaces>"

Check:

VLAN interfaces (e.g., vlan20, vlan99)
Assigned IPs
Correct bridge bindings

Gotcha: Misassigned VLANs are the #1 cause of connectivity and logging failures in labs.

Firewall Rule Management

Reload rules without reboot:

pfctl -f /tmp/rules.debug
pfctl -e
pfctl -sr  # view active rules

Routing & Gateway Checks

netstat -rn
dpinger -S

IDS/IPS (Suricata)

ps aux | grep suricata
tail -f /var/log/suricata/eve.json

These logs are critical for SOC ingestion.

Operator’s Lens: Always verify rules and logs at the CLI before assuming the GUI is accurate.

2️⃣ Terraform + Proxmox: Automating Infrastructure

Lesson: Manual VM deployment scales poorly. IaC ensures repeatability, auditability, and disaster recovery.

Terraform Provider Example

terraform {
  required_providers {
    proxmox = { source = "Telmate/proxmox" }
  }
}

provider "proxmox" {
  pm_api_url      = "https://proxmox.local:8006/api2/json"
  pm_user         = "terraform@pve"
  pm_password     = "STRONG_PASSWORD"
  pm_tls_insecure = true
}

VM Deployment Example

resource "proxmox_vm_qemu" "linux_server" {
  name        = "srv-linux-01"
  target_node = "pve01"
  clone       = "ubuntu-template"
  cores       = 4
  memory      = 4096

  network {
    model  = "virtio"
    bridge = "vmbr0"
    tag    = 20
  }

  disk {
    size    = "40G"
    type    = "scsi"
    storage = "local-lvm"
  }
}

IaC benefits:

Consistent builds
Rapid teardown and rebuild
Version-controlled infrastructure

Operator’s Lens: A misconfigured template can break your entire VLAN configuration. Test small, then scale.

Gotcha: Forgetting to tag NICs correctly in Terraform can silently break inter-VLAN routing.

Recovery Tip: Combine Terraform builds with Proxmox snapshots to restore systems after testing or simulated failures.

3️⃣ SOC Log Forwarding & Observability

Lesson: Security tooling without well-defined log flows is security theater.

pfSense → Graylog (Syslog)

GUI: Status → System Logs → Settings → Enable Remote Logging
Target: 192.168.99.50, Transport: UDP 514
CLI verification: tcpdump -i vlan99 port 514

Proxmox → SIEM

Edit /etc/rsyslog.d/60-graylog.conf:

*.* @192.168.99.50:514

Restart: systemctl restart rsyslog

Windows (AD) → SIEM

Install Wazuh agent or NXLog
Forward security & directory service logs
Key events: Auth (4624/4625), Kerberos (4768/4769), User creation/deletion (4720/4726)

Operator’s Lens: Every missing log is a blind spot. Confirm that logs actually arrive in your SIEM before running attack simulations.

Gotcha: Misconfigured transport (UDP vs TCP) or firewall rules often block logs silently.

4️⃣ Active Directory Lab Hardening Playbooks

Thesis: Identity is the real perimeter. Networks define where traffic can go; identity defines who can act.

Baseline Hardening

Domain Controllers

No internet access
Separate VLAN
Limited admin access

Accounts

Disable default Administrator login
Tiered admin model: Domain Admin / Server Admin / Workstation Admin

GPO & Security Policies

Passwords: 14+ chars, lockout after 5 attempts
Disable legacy protocols: NTLMv1, SMBv1, LLMNR

Service Accounts

Use gMSA when possible
Deny interactive logon
Rotate credentials regularly

Logging & Detection

Enable Advanced Audit Policy
PowerShell and command-line logging
Forward logs to SIEM for lateral movement, credential abuse, persistence detection

Attack → Detect → Harden Cycle

Simulate Kerberoasting, Pass-the-Hash, Golden Tickets
Detect via SIEM
Apply policy remediation

Operator’s Lens: Every AD misconfiguration is a potential blind spot. Test attacks, detect, then harden.

Recovery Tip: Use Terraform + snapshots to rebuild compromised DCs quickly and safely.

Gotcha: Leaving default admin accounts enabled or unmonitored log sources can make simulated attacks unrealistic.

What Your Lab Now Represents

Your lab is now functionally a small enterprise:

Segmented networking with enforced routing
Virtual firewall as central control plane
Automated provisioning via Terraform and Ansible
Centralized logging and observability
Hardened identity services with AD best practices

Operator’s Lens: The more realistic your simulations, the better your reflexes for real incidents. Recovery and observability are the real differentiators.

This is no longer just a home lab—it is a platform for practicing operations, detection, and recovery.

Reader Challenge

Simulate a compromised server or account.
Trace what logs would alert you.
Apply recovery using IaC and snapshots.
Harden policies to prevent recurrence.

Operator’s Lens: Practice incident response reflexively. Every simulation teaches operational discipline.

Up Next: Part 4

Part 4 will explore:

Kubernetes & container security
Secrets management and CI/CD inside the lab
Advanced SOC integration and incident response workflows

Virtology