- The Catalyst: After completing the CCNA, I required a centralized, enterprise-emulated environment to transition from foundational networking concepts to applied security and infrastructure automation.
- The Objective: Provision a secure, Software-Defined Networking (SDN) lab completely isolated from residential traffic. This environment actively supports my hands-on preparation for the CompTIA CySA+ and Microsoft AZ-104 certifications by providing a safe sandbox for offensive/defensive simulations and cloud-hybrid infrastructure testing.
- Edge Perimeter (TP-Link ER605): Utilizing the actual residential home router as its backbone WAN connection, this gateway acts as the dedicated lab perimeter. It handles Router-on-a-Stick inter-VLAN routing to the private VLANs configured on the switch, enforces physical network boundaries, and hosts a daily-driven OpenVPN server for secure remote ingress.
- Layer 2 Distribution (TP-Link SG2008): A managed smart switch enforcing physical Network Access Control (NAC), port security, and 802.1Q trunking to prevent tampering and isolate traffic flows.
- Bare-Metal Virtualization (Proxmox VE): A repurposed HP laptop operating as a Type 1 Hypervisor, maximizing compute efficiency for the virtual datacenter.
- SDN & Virtual Routing (Omada & OPNsense): An Omada SDN controller hosted in a lightweight LXC container handles programmatic automation and network orchestration, while a virtualized OPNsense instance acts as an internal firewall and gateway for the virtualized security enclaves.
- NetDevOps & Out-of-Band Control (Raspberry Pi 4): The "Pi-bot" provides dedicated Out-of-Band (OOB) management as a failsafe access point, and functions as the primary Ansible control node for automated infrastructure provisioning and configuration management.
flowchart TD
%% Styling Definitions
classDef hardware fill:#2d3436,stroke:#74b9ff,stroke-width:2px,color:#fff;
classDef virtual fill:#636e72,stroke:#00b894,stroke-width:2px,color:#fff,stroke-dasharray: 5 5;
classDef vlan100 fill:#6c5ce7,stroke:#a29bfe,stroke-width:2px,color:#fff;
classDef vlan10 fill:#0984e3,stroke:#74b9ff,stroke-width:2px,color:#fff;
classDef vlan20 fill:#d63031,stroke:#ff7675,stroke-width:2px,color:#fff;
classDef vlan30 fill:#00b894,stroke:#55efc4,stroke-width:2px,color:#fff;
classDef external fill:#b2bec3,stroke:#636e72,stroke-width:2px,color:#2d3436;
Internet((ISP / Internet)) --> HomeRouter[Residential Home Router<br/>WAN Backbone]:::external
HomeRouter -->|WAN Handoff| Edge[TP-Link ER605 Gateway<br/>Edge Firewall & OpenVPN]:::hardware
Edge -->|Router-on-a-Stick<br/>Inter-VLAN Routing| Switch[TP-Link SG2008<br/>Managed Switch]:::hardware
%% Out of Band Management
Switch -->|Access Port| Pi[Raspberry Pi 4 'Pi-bot'<br/>Ansible OOB Controller]:::hardware
%% Hypervisor & Virtualization
subgraph Proxmox [HP Laptop - Proxmox Type 1 Hypervisor]
direction TB
vSwitch((Proxmox Linux Bridge<br/>Virtual Switch)):::virtual
OPNsense{OPNsense Virtual Firewall<br/>Internal Enclave Gateway}:::virtual
subgraph Mgmt [VLAN 100: Management]
Omada[Omada SDN Controller LXC]:::vlan100
end
subgraph Mon [VLAN 10: Monitoring]
Wazuh[Wazuh SIEM Manager]:::vlan10
MISP[MISP Threat Intel]:::vlan10
end
subgraph Red [VLAN 20: RedNet]
RedTeam[Offensive Emulation]:::vlan20
end
subgraph Blue [VLAN 30: BlueNet]
BlueTeam[Defensive Targets]:::vlan30
end
%% Routing and Trunks
vSwitch <==>|Trunk| OPNsense
OPNsense --->|VLAN 100| Omada
OPNsense --->|VLAN 10| Wazuh
OPNsense --->|VLAN 10| MISP
OPNsense --->|VLAN 20| RedTeam
OPNsense --->|VLAN 30| BlueTeam
end
Switch -->|802.1Q Trunk| vSwitch
To maximize compute efficiency and maintain a strict security boundary, the environment runs entirely on dedicated physical hardware managed via an out-of-band architecture.
| Core Hypervisor & SDN Stack | Out-of-Band Control Station |
|---|---|
 |
 |
| Bare-metal Proxmox Type 1 Hypervisor orchestrating core virtualized infrastructure alongside the Omada SDN gateway and managed switch. | The 'Pi-bot' out-of-band management console displaying localized automated deployment status via the companion display. |
Visual confirmation of the operational state of the conceptual lab environment and network boundary enforcement, managed via the central Omada SDN Controller and Proxmox VE.
🛠️ Click to View Visual Verification Gallery
The Proxmox VE hypervisor running the virtualized firewall (OPNsense), monitoring nodes, and stopped Packer golden templates.
Visual inventory confirming the active management of the physical TP-Link ER605 gateway and SG2008 switch.
Omada SDN configuration confirming the exact subnetting and 802.1Q VLAN isolation (Management, Monitoring, RedNet, BlueNet) mapped in the architecture diagram.
Active OpenVPN server configured on the ER605 edge gateway, providing encrypted, daily-driven remote ingress to the lab environment.
Visual proof of active routing. The Terraform-provisioned VMs are successfully tagged and monitored within VLAN 10 (Monitoring), while core infrastructure remains isolated in the Management enclave.
With modern networking professionals moving towards automated solutions to build, provision and configure their networks, I took a netdevops approach towards provisioning the machines that will be hosted locally within my Proxmox environment.
To ensure the environment is reproducible, scalable, and resilient, I utilized the following IaC stack for CI/CD control, idempotency, and true practice implementing and trading off use cases of each tool:
Automated generation of baseline Ubuntu and Debian cloud-init templates, customized specifically for the Proxmox environment.
Virtual machines are provisioned dynamically across the designated VLANs using the Proxmox API. Example: The Wazuh SIEM manager and MISP threat intelligence nodes are declaratively assigned their resources and tagged into VLAN 10 (Monitoring) at the time of creation.
The Raspberry Pi 4 ('Pi-bot') acts as the central out-of-band control node. Configuration management is executed in a structured, three-phase approach:
Phase A: Pre-Flight Validation & SSH Auth
Configuring ansible.cfg to bypass host key checking for dynamic environments, followed by a successful ansible -m ping ad-hoc command to verify passwordless SSH authentication to the monitoring nodes.
Phase B: Baseline Enforcement
Execution of the ubuntu_baseline.yml playbook, demonstrating declarative package management, system updates, and security tool installations across the VLAN 10 enclave.
Phase C: Playbook Recap & Verification
Final play recap confirming successful configuration states and task changes across both the Wazuh and MISP servers, effectively validating the automation pipeline.
Working with IaC provisioning tools highlights the necessity of operational helper scripts. Whether utilizing community repositories or crafting custom solutions, Bash has been instrumental in reducing downtime and mitigating failed Packer, Terraform, or Ansible deployments. As a programming enthusiast, I actively leverage these opportunities to refine my scripting skills, developing targeted utilities for system management and infrastructure cleanup.
cleanup_pve.sh: A rapid-response cleanup script utilizing the ProxmoxqmCLI in a Bash loop to rapidly halt and destroy specific VM deployments, ensuring a clean state for rapid IaC redeployment testing.
Execution of the cleanup_pve.sh script to tear down the Wazuh and MISP nodes.
ansible_find_ip.sh: A targeted IP gathering tool designed for the control node. It utilizesnmapto scan provided network ranges specifically for active hosts with open SSH ports (Port 22), usingawkto parse the output for immediate use in Ansible inventories.
Reviewing the ansible_find_ip.sh logic on the Pi-bot control node.