Home Lab
The Albuquerque lab is a seven-VM environment running on a dedicated NucNano Proxmox host. It supports Active Directory administration, Windows endpoint testing, private remote access, honeypot telemetry, Splunk development, and the Hayabusa MCP project.
Physical environment
The NucNano is dedicated to Proxmox. A separate mini PC, Nuc Sr., runs bare-metal Kali Linux and Windows 11 Pro from separate drives: F7 picks the room. A MacBook Pro is the primary lab administration system, while a Dell Premium 16 and Dell OptiPlex 7020 provide professional Windows environments for school and work.
NucNano, the dedicated Proxmox virtualization host.
Virtual architecture
- DC01: Windows Server 2025 domain controller providing Active Directory Domain Services, DNS, authentication, and Group Policy.
- fileserver: Domain-joined Windows Server providing SMB shares and Group Policy folder redirection.
- linuxvpn: Ubuntu Server providing Tailscale subnet routing and exit-node services.
- WIN11-CLIENT: Domain-joined Windows 11 endpoint for user, policy, and remote-access testing.
- honeypot01: Ubuntu Server running an internal Cowrie SSH honeypot.
- splunk01: Ubuntu Server running Splunk Enterprise for log-analysis development.
- hayabusa-mcp: Ubuntu Server development environment for a security-focused Hayabusa MCP server.
Windows guests use VirtIO storage and network drivers provided through the virtio-win ISO.
DC01 after Active Directory promotion and DNS configuration.
The fileserver centralizes domain-user documents through Group Policy folder redirection versus keeping them only on individual endpoints.
Folder redirection applied through Group Policy to a domain user.
Remote administration
The Ubuntu linuxvpn VM provides Tailscale subnet routing and exit-node services. Approved tailnet devices can reach Proxmox, SSH, RDP, and internal web interfaces without inbound router port forwarding. The configuration was tested from Greece, including remote administration of the Proxmox environment.
Redacted Tailscale configuration for the lab subnet router and exit node.
Monitoring and recovery
honeypot01 runs Cowrie as an internal SSH honeypot on TCP/2222. Tests from bare-metal Kali produced connection, authentication, and session events in Cowrie’s text and JSON logs. The logs were exported and reviewed with jq. splunk01 runs Splunk Enterprise; installation and web access are verified, while Cowrie ingestion, Windows event forwarding, dashboards, and alerts remain under development.
Cowrie connection events filtered from JSON logs with jq; source IP addresses are redacted.
All seven VMs were restored after the original NVMe developed repeatable read errors. Recovery included ddrescue imaging and targeted repair of damaged Windows files on DC01.
Related security testing and findings are documented in Security & Defense.
Current Network (Albuquerque, NM)
The Albuquerque network uses a four-node TP-Link Deco 6E tri-band mesh. The ISP gateway operates in bridge mode, with routing and wireless services handled by the Deco system. One mesh node uses wireless backhaul and provides an Ethernet handoff to the Proxmox home lab.
ISP gateway in bridge mode beside a Deco 6E mesh node handling routing and wireless services.
IoT devices occupy a separate VLAN with dedicated wireless credentials. Device Isolation restricts communication among selected IoT devices, while a MAC-address block list prevents specified devices from connecting to the network. The guest network is disabled.
Wireless performance is surveyed with NetSpot on mobile and desktop using the home blueprints as a floor plan. Measurements cover download and upload throughput, signal level, noise, interference, channel overlap, and access-point coverage. Test points span the residence and garage, and surveys are repeated every few months to document changes in coverage and performance.
NetSpot download-speed survey plotted against the home floor plan, with measurements collected throughout the residence and garage.
Remote Network Management (Virginia)
The Virginia network serves a four-level, 105-year-old residence with thick walls and dense construction. Fiber service is delivered through a Calix gateway to a four-node eero Beacon mesh distributed between the basement, primary floors, and full-sized attic.
An eero mesh node positioned to provide coverage through dense, multi-floor construction.
A second eero node extending coverage between levels of the Virginia residence.
A dedicated router supports the IoT network used for remote control of the thermostat, lighting, and other household systems. The network is administered from Albuquerque, more than 1,800 miles away.
Network Design Approach
Each network decision is tied to a specific operational requirement: domain services remain inside the lab, remote administration uses Tailscale instead of inbound port forwarding, IoT devices receive separate controls, and wireless changes are evaluated through repeatable NetSpot surveys. Configuration claims are backed by direct testing, including Group Policy validation, Cowrie session logging, remote Proxmox administration from Greece, and recurring throughput and RF measurements.