Home Lab
A segmented home network running a SIEM, self-hosted services, and a hypervisor — built to test detections, break things deliberately, and learn from what happens.
- Ubiquiti UniFi
- Proxmox
- Security Onion
- Pi-Hole
- WireGuard
- TrueNAS
01 / Network VLAN segmentation from day one
The home network runs four isolated segments: trusted devices, IoT, servers, and guest. Each sits on its own VLAN with firewall rules enforced at the switch layer by Ubiquiti UniFi. IoT devices can’t reach trusted hosts. Guest traffic is fully isolated. The segmentation is the baseline — everything else runs on top of it.
02 / Services What runs in the lab
A Proxmox hypervisor hosts the VMs and containers:
- Security Onion — full-packet capture, SIEM, and IDS for the home network. Detection rules get written and tuned here before they go anywhere near a production environment.
- Pi-Hole — DNS-level blocking with custom blocklists. DNS query logs feed into Security Onion for additional visibility.
- WireGuard VPN — remote access back into the trusted VLAN when off-network. Nothing is exposed directly to the internet.
- TrueNAS — local storage for backups and media, isolated on the server VLAN.
03 / Why A place to break things
The lab exists to run experiments that would get flagged at work. New detection rules get tested here first against real traffic. Security Onion provides full packet capture so a rule can be validated to fire on the right traffic — and stay quiet on everything else — before it ever enters a production detection stack.
It’s also the environment where the home automation and AI agent work lives. Real VLAN boundaries and real network traffic make that work meaningful in a way a simulator can’t replicate.