---
title: 'How to Build a Cybersecurity Homelab from Scratch'
url: 'http://itlad.uk/blog/cybersecurity-homelab-getting-started'
markdown: 'http://itlad.uk/blog/cybersecurity-homelab-getting-started.md'
date: '2026-05-27'
description: 'Build a cybersecurity homelab from scratch — isolated lab network, Kali Linux, vulnerable VMs, SIEM setup and the hardware you need to get started.'
taxonomy:
  category:
    - cybersecurity
    - homelab
  tag:
    - cybersecurity
    - homelab
    - 'kali linux'
    - 'security lab'
    - 'pen testing'
---

[ Home ](http://itlad.uk/)     [ Blog ](http://itlad.uk/blog)      How to Build a Cybersecurity Homelab from Scratch    

# [How to Build a Cybersecurity Homelab from Scratch](http://itlad.uk/blog/cybersecurity-homelab-getting-started)

 By [IT Lad](http://itlad.uk/about) 27 May 2026 

  [cybersecurity](http://itlad.uk/blog/tag:cybersecurity#body-wrapper) [homelab](http://itlad.uk/blog/tag:homelab#body-wrapper) [kali linux](http://itlad.uk/blog/tag:kali%20linux#body-wrapper) [security lab](http://itlad.uk/blog/tag:security%20lab#body-wrapper) [pen testing](http://itlad.uk/blog/tag:pen%20testing#body-wrapper)  

A security lab lives on an isolated network. This is not optional — practice environments include intentionally vulnerable systems, and you do not want them reachable from your main LAN.

## Network Architecture

The lab needs its own VLAN or physical segment:

```
Internet
    └─ Router/Firewall (pfSense or OPNsense)
          ├─ Main LAN (VLAN 10)
          ├─ IoT (VLAN 20)
          └─ Security Lab (VLAN 99) ← isolated, no access to other VLANs
```

Block VLAN 99 from reaching VLAN 10 at the firewall. Allow internet access for downloading tools, but firewall it off from your real machines.

## The Attack Platform: Kali Linux

Run Kali as a VM in Proxmox. It comes with the full tool suite pre-installed — Nmap, Metasploit, Burp Suite, Wireshark, Nikto, Hydra, sqlmap.

Keep a clean snapshot you can revert to. Kali VMs accumulate tool conflicts fast.

## Target Machines: Intentionally Vulnerable VMs

Deploy these in your lab VLAN:

- **Metasploitable 2/3** — Linux VM riddled with vulnerabilities, good for Metasploit practice
- **DVWA** (Damn Vulnerable Web Application) — web app security practice (SQLi, XSS, file inclusion)
- **VulnHub machines** — weekly CTF-style VMs with walkthroughs after you solve them
- **HackTheBox / TryHackMe** — cloud-based labs if you don't want to run local targets

## SIEM: Wazuh

Wazuh is a free, open-source SIEM that runs on-prem. Deploy the Wazuh server as a Docker stack and install agents on your lab VMs. It collects logs, detects intrusion patterns and generates alerts.

The [Wazuh documentation](https://documentation.wazuh.com) covers Docker deployment in detail. Run it on a VM with at least 4GB RAM.

## Packet Capture: Zeek + Arkime

Zeek (formerly Bro) analyzes network traffic and generates structured logs — DNS queries, HTTP requests, connection summaries. Arkime (formerly Moloch) stores and indexes full packet captures with a search UI.

Both run well on a server with a spare NIC connected to a mirror port on your lab switch.

## Hardware for the Lab

- [TP-Link TL-SG108E managed switch](https://www.amazon.com/s?k=tp-link%2Btl-sg108e%2Bmanaged%2Bswitch&tag=itlad-21) — VLAN isolation for the lab segment
- [Proxmox host with 32GB RAM](https://www.amazon.com/s?k=mini%2Bpc%2B32gb%2Bram%2Bhomelab&tag=itlad-21) — runs Kali, Wazuh and 4–5 target VMs simultaneously
- [Alfa AWUS036ACH Wi-Fi adapter](https://www.amazon.com/s?k=alfa%2Bawus036ach%2Bwifi%2Badapter&tag=itlad-21) — monitor mode for wireless security practice

Start with Kali + Metasploitable + Wazuh. That gives you an attacker, a target and a detector — the core of any security lab.

---

*As an Amazon Associate, IT Lad earns from qualifying purchases made through links on this page. [Read the full affiliate disclosure](http://itlad.uk/affiliate-disclosure).*

 [ Previous Post](http://itlad.uk/blog/raspberry-pi-projects-it-guys) [Next Post ](http://itlad.uk/blog/best-kvm-switches-multi-monitor)

#### Syndicate

 [ Atom 1.0](http://itlad.uk/blog.atom) [ RSS](http://itlad.uk/blog.rss)

---

## Navigation

- Parent: [Blog](http://itlad.uk/blog.md)
- Previous: [Best KVM Switches for Multi-Monitor and Multi-Computer Setups](http://itlad.uk/blog/best-kvm-switches-multi-monitor.md)
- Next: [7 Raspberry Pi Projects Every IT Guy Should Build](http://itlad.uk/blog/raspberry-pi-projects-it-guys.md)