Module Introduction

The Infrastructure & Virtualization phase is where the home lab starts to take shape. In this part of the project, the focus is on setting up the underlying platform that will host all virtual machines, security tools, and network services. Since virtualization is the backbone of any modern SOC or cybersecurity environment, understanding how it works and how to configure it properly is a crucial step in building a functional and scalable lab.

This module is designed to help you plan and deploy a virtualized environment that is flexible, efficient, and easy to manage. The goal is not just to install a hypervisor but to understand how resources are allocated, how virtual machines interact with each other, and how the infrastructure can grow as your project evolves

3.1 Virtualization Strategy Overview

Virtualization allows you to run multiple independent systems (VMs) on a single physical machine. Instead of needing several physical servers for different roles (like a firewall, SIEM, or vulnerability scanner), you can create them virtually on one host, saving space, power, and cost which is ideal for a home lab.

There are two main types of virtualization technologies:

• Type 1 Hypervisors:

1. Installs directly on the physical hardware, providing direct access to resources.
2. Offers superior performance and security compared to Type 2
3. Popular choices: Proxmox VE, VMware ESXi, XCP-ng
4. Can be more complex to install and manage

• Type 2 Hypervisors:

1. Runs as software on top of an existing operating system (OS)
2. Easier to install and manage than Type 1
3. Less resource-intensive and suitable for lighter workloads
4. Popular choices: VirtualBox, Oracle VM VirtualBox, VMware Workstation Player

Performance and security can be impacted by the underlying OS

In this project, Proxmox VE (a Type 1 hypervisor) is the platform of choice; Proxmox Virtual Environment is a complete, open-source server management platform for enterprise virtualization. Tailored for home lab enthusiasts diving into enterprise level virtualization. This versatile system seamlessly integrates the KVM hypervisor, Linux Containers (LXC), and software defined storage and networking functionality onto a unified platform. The user friendly web based interface simplifies the management of Virtual Machines (VMs) and containers, while also offering features such as high availability for clusters and integrated disaster recovery tools.

Example Use Case:

• You can run a pfSense firewall, a Wazuh SIEM server, a Windows domain controller, and a Kali Linux VM, all on the same physical machine and manage them from a single dashboard.

3.2 Host Resource Planning (CPU, RAM, Storage)

In all the courses, guides, and recommendations I found, and based on which I am building this project, I saw that many experts use a hypervisor on their own laptops to create the entire virtual lab. In my opinion (and other experts too), it’s best to use a computer different to yours to install or configure the entire lab, since you’ll be working with malware or any other types of attacks on the infrastructure. What better way to protect your computer and network than with a different one, don’t you think?

Resource planning ensures your lab runs smoothly without overloading your hardware. Because multiple VMs will run simultaneously, balancing CPU, RAM, and storage is essential.

Recommended Initial Setup (for small-to-medium labs):

• CPU: 8+ cores (support for virtualization extensions like Intel VT-x or AMD-V)
• RAM: 32 GB minimum (64 GB preferred for multiple active VMs)
• Storage: 1 TB SSD/NVMe (fast read/write improves VM performance)
• Networking: 1 Gbps NIC for internal traffic and external connectivity

What I am using right now: Core Workstation (for the whole lab) and planning to upgrade (server machine)

• ASUS MiniPC PN53-BB7000X1TDR-NL
• CPU: AMD Ryzen 7 6800H 8 cores – 16 Threads up to 4.7GHz / base 3.2GHz
• RAM: 64 GB DDR5 4800MHz
• Storage: 512gb M.2 NVMe PCI2 + 1 TB SSD SATA 2.5
• Networking:5 Gb LAN

NOTE: The other thing you can do (I tried it when I was just starting this project) is use old equipment or equipment you have lying around…

3.2.1 Resourceful Optimization / Hardware

While high end equipment can undoubtedly enhance a cybersecurity home lab, its acquisition isn’t a prerequisite for meaningful learning. You can try leveraging readily available hardware, maximizing resource utilization, and building a functional lab environment.

Core Workstation (for the hypervisor)

Repurposed Desktop/Laptop: Minimum specs of 16GB RAM (32GB Optimal), 500GB storage, and 4 core processor offer a solid foundation.

Unused laptops or desktops, even with lower specs, serve as valuable systems for vulnerability testing and security assessments. Not only unused, maybe you have more laptops or desktops, and some family machines that you can add to your lab.

What I used for the “server” machine for the first time I was building this. Not the actual one.

HP Laptop 15-dy1012la

• Intel Core i5-1035G1
• 16 GB DDR4-2666 SDRAM
• 512 GB PCIe® NVMe™ M.2 SSD
• Intel® UHD Graphics
• 802.11b/g/n (1×1) Wi-Fi® and Bluetooth® 4.2 combo
• Adapter for connectivity through ethernet cable, more stable.

Manager Workstation

You will use another machine to access your «server» machine.

What I used and still using for the “manager” machine:

HP Victus

• Intel Core i5-11400H
• 32 GB DDR4-3200 SDRAM
• 512 GB PCIe® NVMe™ M.2 SSD + 1 TB PCIe® NVMe™ M.2 SSD
• GPU NVIDIA GeForce GTX 1650

Tips:

• Allocate more resources to intensive services like SIEM or vulnerability scanners.
• Keep some free capacity for testing new tools or running resource-heavy scans.
• Use separate storage volumes or partitions for backups and snapshots.

3.3 Proxmox VE Deployment and Configuration

Proxmox VE serves as the central management platform for the lab. It allows you to create, configure, and monitor all virtual machines and containers from a web-based interface. Its built-in features like clustering, snapshots, backup, and storage integration make it ideal for a long term learning environment.

Basic Steps for Deployment:

1. Download the latest Proxmox VE ISO.
2. Install it directly on the host hardware.
3. Access the web GUI via a browser and perform the initial setup (network, storage, admin user).
4. Create virtual machines or containers for different lab components (e.g., pfSense, SIEM, AD, etc.).

Configuration Tips:

• Assign sufficient CPU and memory to each VM based on its role.
• Use LXC containers for lightweight services like web servers or monitoring agents.
• Create templates for commonly used configurations to save time.

NOTE: For the complete step-by-step guide to implementing a Proxmox environment, click on the following link:

Building the Foundation: Step-by-Step Proxmox Virtual Environment (Proxmox VE)

3.4 VM Creation and Management

Once Proxmox is installed, you can begin creating the virtual machines that make up the different layers of your lab. Each VM serves a specific purpose, for example, one might act as a domain controller, while another could run your SIEM platform.

Best Practices:

• Use descriptive names for each VM (e.g., Firewall-pfSense, SIEM-Wazuh, Scan-Nessus).
• Take snapshots before major changes, so you can revert if something goes wrong.
• Use templates to quickly deploy new instances with predefined settings.
• Organize VMs into groups based on their role (network, security, services, testing).

Example VM Layout:

• Core Services: Windows Server (AD/DNS), Linux server (web/mail), pfSense (firewall)
• Security Layer: Wazuh, Security Onion, OpenVAS
• Testing Layer: Kali Linux, Metasploit, Malware analysis sandbox

Now, we are going to create our first virtual machine, and this will be for our firewall.

3.5 pfSense Firewall Deployment and Configuration

The firewall is the central security control of the network. In this project, pfSense is used as the primary firewall solution because it is open source, highly configurable, and widely used in both enterprise and lab environments.

Key responsibilities of the firewall in the lab:

• Control traffic between VLANs using rules and policies.
• Perform network address translation (NAT) to simulate internet access.
• Block unauthorized communication between segments.
• Allow logging and inspection of traffic for analysis and troubleshooting.

 Basic Setup Steps:

1. Deploy pfSense as a virtual machine in Proxmox.
2. Assign one interface as the WAN (external/untrusted) and another as the LAN (internal).
3. Create additional interfaces for each VLAN.
4. Configure firewall rules based on the lab design (e.g., Security VLAN can access Corporate LAN, but not vice versa).
5. Set up logging and monitoring to track all traffic passing through the firewall.

NOTE: For the complete step-by-step guide to implementing a firewall with pfSense, click on the following link:

Choosing My Trusted Guardian – The Power of pfSense

3.6 Container Use Cases and LXC Setup

In addition to full virtual machines, Linux Containers (LXC) can be used for lightweight tasks and microservices. Containers share the host OS kernel, so they are faster to deploy and require fewer resources.

When to Use Containers:

• For running lightweight tools like web dashboards, log forwarders, or small databases.
• For automation tasks and testing APIs.
• For services that don’t require full isolation or their own kernel.

Example:

• Deploying a container to run a vulnerability management dashboard.
• Running a container-based honeypot for monitoring attack attempts.

Summary:
The Infrastructure & Virtualization module forms the backbone of the cybersecurity home lab. By deploying Proxmox VE and carefully planning CPU, memory, and storage resources, you create a flexible platform where multiple security components can coexist. The combination of virtual machines for full-featured services and containers for lightweight tasks allows for an efficient, scalable environment.

Starting with a solid virtualization setup ensures that every future part of your SOC from network segmentation and firewalls to SIEM and incident response can be deployed, tested, and improved in a controlled and manageable way.