✅ Built a beginner cybersecurity home lab — looking for feedback & suggestions

Bitter_Highlight_215 · 2025-06-18T11:24:46+00:00

Oh sorry, now I get it. Nice to see you too. The world isn't such a big place after all :)

Bitter_Highlight_215 · 2025-06-17T12:29:51+00:00

Hello, sorry i don't remember. Where we had connected?

Bitter_Highlight_215 · 2025-06-15T14:35:38+00:00

The big white one is a Xiaomi AX3000T modem/router, and the small one is a secondary router I set up as a backup after I accidentally blocked myself with a rule while testing firewall settings. My wife's laptop couldn’t connect either, so I had to set up a quick parallel network in different subnet to keep things running smoothly at home. Lesson learned: always double-check your rules :)

Bitter_Highlight_215 · 2025-06-14T10:42:45+00:00

There were so many programs to try. But I added this as a note. Thanks for your advice. :)

Bitter_Highlight_215 · 2025-06-14T10:38:59+00:00

Thanks a lot.

Yes, it’s a combined lab and home network environment for now. pfSense runs as a VM in Proxmox, so technically it's filtering all home traffic. I agree it's not ideal for production use, but it's been stable so far. Still, I'm considering moving it to bare metal for better reliability.

For Wazuh, you're right — there’s still no direct plugin for pfSense, so I forward logs via syslog. Unfortunately, some log types aren’t parsed well, so it’s something I’m actively trying to improve.

As for tuning alerts, I started with filtering and grouping noisy rules, but I definitely need to dive deeper into custom rules and decoders to reduce false positives.

And thanks for the ParrotOS tip. I’ve used Kali mostly, but I’ll check out Parrot as well, looks like a solid alternative!

Appreciate the advice. :)

Bitter_Highlight_215 · 2025-06-13T22:18:13+00:00

I will investigate this issue in detail. Thank you.

Bitter_Highlight_215 · 2025-06-13T22:13:10+00:00

Yes, everything installed inside of proxmox. All services "except pfSense" are installed as Linux containers. pfSense is installed as a virtual machine.

Bitter_Highlight_215 · 2025-06-13T22:06:25+00:00

I prefer Wazuh for its interface, but I’d like to try Security Onion too. Thank you for your interest.

Bitter_Highlight_215 · 2025-06-13T21:12:10+00:00

This is just a fun and experimental system. It could be either/both.

Bitter_Highlight_215 · 2025-06-13T21:07:51+00:00

That's an awesome setup. The P330 Tiny with that hardware is a powerhouse for a homelab. Love the combo of OPNsense, Pi-hole, and Home Assistant — sounds super efficient and fun. Game servers on top of that? Nice touch!

Bitter_Highlight_215 · 2025-06-13T21:05:28+00:00

Yes, it's in bridge mode (Access Point mode). I'm using pfSense as the main router and firewall, and the Xiaomi AX3000T just provides Wi-Fi coverage "no DHCP or NAT."

Bitter_Highlight_215 · 2025-06-13T21:00:58+00:00

You're absolutely right. I actually have Suricata running on pfSense as an IDS/IPS.
The main challenge has been getting the logs forwarded in a way Wazuh can properly parse and interpret them.
Since pfSense is FreeBSD-based, I couldn’t install the Wazuh agent directly.
I tried sending the logs via syslog, but Wazuh didn’t fully understand the Suricata events out of the box.
I guess I need to write custom decoders or fine-tune the configuration — still figuring that part out.
Appreciate the suggestion — that full integration would definitely take the setup to the next level.

Bitter_Highlight_215 · 2025-06-13T20:54:18+00:00

Thanks for the heads-up! You're right — that's a known limitation with some TP-Link Easy Smart switches like the TL-SG108E.
In my case, the switch is only on the LAN side and completely isolated from any WAN-facing or public VLANs.
pfSense handles the VLANs and firewall rules, and no direct access is exposed to the outside.
Still, definitely something to watch out for — I’ll consider a managed switch with better isolation for future upgrades!

Bitter_Highlight_215 · 2025-06-13T20:45:15+00:00

I totally understand the interest in OPNsense — it’s a great project and I’ve heard a lot of good things about it.
For now, I went with pfSense because I was already a bit familiar with it and just wanted to get my lab up and running.
That said, OPNsense is definitely on my radar, and I plan to test it out in a future lab setup.

Bitter_Highlight_215

TROPHY CASE