How to Build a Cybersecurity Homelab from Scratch

A security lab lives on an isolated network. This is not optional — practice environments include intentionally vulnerable systems, and you do not want them reachable from your main LAN.

Network Architecture

The lab needs its own VLAN or physical segment:

Internet
    └─ Router/Firewall (pfSense or OPNsense)
          ├─ Main LAN (VLAN 10)
          ├─ IoT (VLAN 20)
          └─ Security Lab (VLAN 99) ← isolated, no access to other VLANs

Block VLAN 99 from reaching VLAN 10 at the firewall. Allow internet access for downloading tools, but firewall it off from your real machines.

The Attack Platform: Kali Linux

Run Kali as a VM in Proxmox. It comes with the full tool suite pre-installed — Nmap, Metasploit, Burp Suite, Wireshark, Nikto, Hydra, sqlmap.

Keep a clean snapshot you can revert to. Kali VMs accumulate tool conflicts fast.

Target Machines: Intentionally Vulnerable VMs

Deploy these in your lab VLAN:

• Metasploitable 2/3 — Linux VM riddled with vulnerabilities, good for Metasploit practice
• DVWA (Damn Vulnerable Web Application) — web app security practice (SQLi, XSS, file inclusion)
• VulnHub machines — weekly CTF-style VMs with walkthroughs after you solve them
• HackTheBox / TryHackMe — cloud-based labs if you don't want to run local targets

SIEM: Wazuh

Wazuh is a free, open-source SIEM that runs on-prem. Deploy the Wazuh server as a Docker stack and install agents on your lab VMs. It collects logs, detects intrusion patterns and generates alerts.

The Wazuh documentation covers Docker deployment in detail. Run it on a VM with at least 4GB RAM.

Packet Capture: Zeek + Arkime

Zeek (formerly Bro) analyzes network traffic and generates structured logs — DNS queries, HTTP requests, connection summaries. Arkime (formerly Moloch) stores and indexes full packet captures with a search UI.

Both run well on a server with a spare NIC connected to a mirror port on your lab switch.

Hardware for the Lab

• TP-Link TL-SG108E managed switch — VLAN isolation for the lab segment
• Proxmox host with 32GB RAM — runs Kali, Wazuh and 4–5 target VMs simultaneously
• Alfa AWUS036ACH Wi-Fi adapter — monitor mode for wireless security practice

Start with Kali + Metasploitable + Wazuh. That gives you an attacker, a target and a detector — the core of any security lab.

As an Amazon Associate, IT Lad earns from qualifying purchases made through links on this page. Read the full affiliate disclosure.