↓ Skip to main content
Dash Ivey

PekNet Home Lab Intro and Plan

Dash Ivey
Author
Dash Ivey
Table of Contents

Introduction
#

Project Overview
#

PekNet is my personal home lab environment, built around a Dell R720 server with VMWare ESXi. This lab will combine virtualization, networking, Windows and Linux administration, infrastructure services, and cybersecurity. The entire project will be documented here on my blog to help show my skills and serve as a portfolio project. My goal is to post at least once per week. Posts will also be way more technical and include things like snippets of configurations, code, and screenshots. PekNet will be different from my previous home labs and projects due to it’s complexity, better harmonization between services and systems, and also the development plan. I realized my previous lab was very disorganized and became hard to manage. Due to the methodical planning I have done, PekNet will not only be easier to manage but hopefully work more smoothly.

Architecture Overview
#

┌───────────────────────────────────────────────────────────────────────┐
│                         PEK-ESXI-CORE                                 │
│                    Dell R720 / Physical ESXi                          │
│                                                                       │
│   ┌──────────────────────┐              ┌──────────────────────┐      │
│   │ PEK-RTR01            │              │ PEK-VC01             │      │
│   │ RouterOS CHR         │              │ VMware vCenter       │      │
│   └──────────────────────┘              └──────────────────────┘      │
│                                                                       │
│   ┌─────────────────────────────┐      ┌─────────────────────────────┐│
│   │ PEK-ESX01                   │      │ PEK-ESX02                   ││
│   │ Nested ESXi                 │      │ Nested ESXi                 ││
│   │ Infrastructure Host         │      │ Workload / Client Host      ││
│   │                             │      │                             ││
│   │ ┌─────────────────────────┐ │      │ ┌─────────────────────────┐ ││
│   │ │ PEK-DC01                │ │      │ │ PEK-WIN01               │ ││
│   │ │ Windows Server          │ │      │ │ Windows 11              │ ││
│   │ │ AD / DNS / GPO          │ │      │ └─────────────────────────┘ ││
│   │ └─────────────────────────┘ │      │                             ││
│   │                             │      │ ┌─────────────────────────┐ ││
│   │ ┌─────────────────────────┐ │      │ │ PEK-WIN02               │ ││
│   │ │ PEK-WAZUH01             │ │      │ │ Windows 11              │ ││
│   │ │ Wazuh SIEM              │ │      │ └─────────────────────────┘ ││
│   │ └─────────────────────────┘ │      │                             ││
│   │                             │      │ ┌─────────────────────────┐ ││
│   │ ┌─────────────────────────┐ │      │ │ PEK-WIN03               │ ││
│   │ │ PEK-LINUX01             │ │      │ │ Windows 11              │ ││
│   │ │ Linux Infrastructure    │ │      │ └─────────────────────────┘ ││
│   │ └─────────────────────────┘ │      │                             ││
│   │                             │      │ ┌─────────────────────────┐ ││
│   │                             │      │ │ Future Lab / Attack VMs │ ││
│   │                             │      │ └─────────────────────────┘ ││
│   └─────────────────────────────┘      └─────────────────────────────┘│
│                                                                       │
└───────────────────────────────────────────────────────────────────────┘

My Dell R720 is running VMWare ESXi and run the main virtualization components required to build a nested vSphere environment. I have opted to do a nested ESXi environment to help mimic multiple physical servers in a vSphere cluster.

Core Components

  • PEK-RTR01: Virtual router using RouterOS to provide routing, firewall, and other network services for the PekNet environment
  • PEK-VC01: VMWare vCenter instance for centralized management of the nested ESXi hosts
  • PEK-ESX01: VMWare ESXi instance for infrastructure-focused workloads for servers and other services in the environment
  • PEK-ESX02: VMWare ESXi instance for host client machines

Network Architecture
#

PekNet will be using a dedicated private IP address scheme that is separate from my main home LAN. PEK-RTR01 will provide routing through all the VLANs. VLANs will separate the management, servers, clients, security, and vCenter traffic. This segmentation provides both organizational structure and improved security. The network will also be designed to allow for boundaries to be tested rather than trusting all internal systems. The overall network will use a 10.10.0.0/16 address space with each VLAN receiving it’s own /24 subnet. DHCP will be done using a dedicated DHCP server in the management VLAN.

PEKNET VLAN STRUCTURE
│
├── VLAN 10 — MANAGEMENT
│   ├── Network: 10.10.10.0/24
│   ├── Gateway: 10.10.10.1
│   ├── PEK-VC01 ............. 10.10.10.20
│   ├── PEK-ESX01 ............ 10.10.10.21
│   └── PEK-ESX02 ............ 10.10.10.22
│
├── VLAN 20 — SERVERS
│   ├── Network: 10.10.20.0/24
│   ├── Gateway: 10.10.20.1
│   ├── PEK-DC01 ............. 10.10.20.10
│   └── PEK-LINUX01 .......... 10.10.20.20
│
├── VLAN 30 — CLIENTS
│   ├── Network: 10.10.30.0/24
│   ├── Gateway: 10.10.30.1
│   ├── PEK-WIN01 ............ 10.10.30.101
│   ├── PEK-WIN02 ............ 10.10.30.102
│   └── PEK-WIN03 ............ 10.10.30.103
│
├── VLAN 40 — SECURITY
│   ├── Network: 10.10.40.0/24
│   ├── Gateway: 10.10.40.1
│   └── PEK-WAZUH01 .......... 10.10.40.10
│
├── VLAN 50 — DMZ
    ├── Network: 10.10.50.0/24
    ├── Gateway: 10.10.50.1
    └── Future vulnerable / exposed VMs

Core Services
#

PekNet will have 4 core services that it will provide:

  • Active Directory for Windows domain environment and provide centralized identity and authentication.
  • Host Clients that will join the PekNet domain to tests Group Policy and AD functions. They will also serve as endpoints for Wazuh monitoring and serve as targets for future cybersecurity scenarios
  • PEK-LINUX01 will provide a linux based workload for different company services like internal dashboards and sites.
  • Wazuh is the centralized cybersecurity service that will monitor all servers and host clients.

More details about each service will be included on the initial starting post for each phase.

Project Phases
#

While PekNet does not have an official end, there will be 5 main phases for building the infrastructure.

Phase 1 — PekNet Networking

  • Deploy PEK-RTR01.
  • Build the VLANs.
  • Configure routing, NAT, DHCP, DNS forwarding, and firewall rules.
  • Establish connectivity between PekNet and the home network.

Phase 2 — vSphere Environment

  • Deploy PEK-VC01.
  • Configure PEK-ESX01 and PEK-ESX02.
  • Create the PekNet vSphere Datacenter and cluster.
  • Configure shared networking and vMotion.
  • Begin experimenting with centralized vSphere management.

Phase 3 — Core Infrastructure

  • Deploy PEK-DC01.
  • Establish Active Directory and DNS.
  • Deploy PEK-LINUX01.
  • Deploy PEK-WAZUH01.
  • Establish the core services required by the rest of the lab.

Phase 4 — Client Environment

  • Deploy Windows client VMs.
  • Join them to the domain.
  • Configure Group Policy.
  • Establish endpoint monitoring.
  • Begin using the environment as a realistic Windows enterprise-style environment.

Phase 5 — Security

  • Harden infrastructure.
  • Configure firewall policies.
  • Improve logging and monitoring.
  • Establish security baselines.
  • Validate network segmentation.

Methodology
#

PekNet will use a modified phased and iterative methodology. Each of these phases will help with establishing a foundation while still allowing for revisions along the way. I will be doing documentation throughout the lifecycle rather than at the end.

The general development cycle will be the following:

Plan
 ↓
Build
 ↓
Test
 ↓
Document
 ↓
Improve
 ↓
Next Task / Phase

Project Goals
#

The overall goal of this project is to build both a functional and scalable environment to mimic an enterprise infrastructure. There will also be other goals that will help me show my knowledge and skills in a practical and realistic way.

Goals:

  • Develop real-world applicable VMWare vSphere skills
  • Build and administor an Active Directory environment
  • Design and implement segmented networks with VLANs
  • Implement a centralized cybersecurity service with Wazuh
  • Develop practical cybersecurity skills with attack-and-defense exercises.