Module Introduction

The Networking & Segmentation architecture serves as the primary foundation of our Cybersecurity Home Lab project, providing the structural framework upon which our virtualized environment operates. When designing this architecture, we consider the complex balance between functionality, security and scalability, with the goal of creating a network infrastructure that not only meets our immediate needs but also anticipates future needs.

Our main goal is to establish a network environment that encourages learning. With this you will be able to have a laboratory where you can do all the tests required to learn more about this world of cybersecurity, but also about virtualization and networks. What we want here is to have the path to infinite possibilities in exploring basic, medium and advanced cybersecurity concepts, perfecting technical skills and pushing the limits of what is possible within our home laboratory environment.

In this module we set the stage for the architecture of our network, where each decision, from VLAN segmentation to traffic management strategies, will allow us to have everything prepared to simulate a real and production environment. Join me in this development, where, like you, I am in the learning stage and putting into practice everything I have learned in my courses and certifications. Let’s transform our home laboratory into a discovery center, here we can do all our practices that the experts in the field teach us.

2.1 Network Design Principles

Before creating any network segments, it’s important to understand the principles that guide secure and functional network design. The objective is to separate traffic based on its purpose and trust level while still enabling controlled communication between the different parts of the environment.

Key design considerations include:

• Segmentation: Dividing the network into isolated zones (VLANs) reduces the risk of lateral movement and improves control.
• Least Privilege: Each segment should only have the access it needs, nothing more.
• Controlled Communication: Use routing and firewall rules to allow only specific types of traffic between zones.
• Scalability: The network should allow for future expansion without needing complete redesign.

This design approach closely reflects how real world enterprise networks are structured, making the lab more realistic and useful for training.

2.2 VLAN Topology and IP Schema

VLANs (Virtual Local Area Networks) are used to logically separate traffic within the lab, even if all devices are connected to the same physical switch or interface. Each VLAN will represent a specific network segment or security zone.

Here’s an example of the VLANs and their roles:

Network Design

Example Scenario:

• A Kali Linux VM in the Corporate WAN VLAN can simulate an external attacker.
• A Windows workstation in the Corporate LAN VLAN can represent an endpoint device.
• SOC tools in the Security Network VLAN can monitor, log, and respond to suspicious traffic.
• Malware samples can be safely detonated inside the Isolated Sandbox VLAN without affecting other systems.

2.3 Routing, NAT, and Traffic Control

Once VLANs and firewall rules are in place, routing and NAT ensure proper communication between networks and simulated external resources.

Routing:
Each VLAN will have a default gateway managed by the pfSense firewall. Inter-VLAN routing will be allowed only where necessary (e.g., Security VLAN accessing logs from the Corporate LAN).

NAT (Network Address Translation):
NAT will allow internal VMs to access external networks (like the internet or simulated WAN) without exposing their real IP addresses, a common practice in enterprise environments.

Traffic Control:
Traffic shaping and bandwidth control can be configured to simulate real world conditions, such as limiting available bandwidth to test how tools respond to constrained environments.

2.4 Network Services (DNS, DHCP, Proxy, etc.)

For a realistic and functional environment, certain network services are essential. These services will be deployed across different segments based on their roles:

• DNS & DHCP: Automatically assign IP addresses and resolve hostnames. Typically hosted on a domain controller or Linux server.
• Proxy Server: Filter and control outbound traffic, simulating enterprise web access policies.
• Syslog / Log Forwarding: Centralize logs from devices and services for monitoring in tools like Wazuh or Security Onion.
• NTP: Synchronize time across all systems, which is crucial for accurate log correlation

2.5 Traffic Monitoring and Flow Analysis

Monitoring network traffic is essential for both security operations and learning. By capturing and analyzing data flows, you can understand how systems communicate, detect anomalies, and validate firewall rules or IDS alerts.

Recommended Tools and Methods:

• Packet Capture (PCAP): Use Wireshark or tcpdump for packet level analysis.
• NetFlow / sFlow: Monitor traffic patterns and volumes.
• SIEM Integration: Forward logs and network events to Wazuh or Security Onion for real time alerting.

Example Exercise:
Run a vulnerability scan from the Security VLAN against the Corporate LAN and analyze how the firewall logs and SIEM respond. This helps you practice real-world investigation and response workflows.

Summary
The Networking & Segmentation module establishes the communication backbone of the cybersecurity home lab. By carefully designing VLANs, configuring pfSense for segmentation and control, and deploying essential network services, the environment becomes more realistic and secure. This setup not only supports day to day lab operations but also enables complex cybersecurity experiments, from penetration tests and malware detonations to incident detection and response simulations.

With a strong network foundation in place, the next modules, such as firewall policies, security tools, and SOC automation, can be deployed more effectively and with a clear understanding of how traffic flows through the system.