🛡️ My Cybersecurity Lab

Defense in depth,
built from scratch.

andro@lab:~$

A multi-layer cybersecurity homelab combining OPNsense, NordVPN, PiHole, Tailscale, and Vaultwarden. From CNC machinist to cybersecurity engineer — this is my journey, documented in code and configs.

📦 View on GitHub → Explore architecture
Architecture

Six layers of defense

Each layer protects independently. If one fails, the others continue defending. This is the essence of defense in depth — and the principle this lab is built around.

Cybersecurity lab architecture diagram
1

NordVPN

Hides home IP, encrypts traffic to the internet via WireGuard tunnel.

2

OPNsense

Killswitch, stateful filtering, network segmentation. Configured by hand.

3

PiHole

DNS-level ad-blocking, tracker blocking, malware domain filtering.

4

Tailscale

Zero-trust mesh VPN. Devices identify cryptographically — no shared passwords.

5

HTTPS + Crowdsec

Application-layer TLS encryption with brute-force protection.

6

VPNNET Segment

Dedicated VPN-routed network: join the WiFi and 100% of traffic exits through NordVPN — kill switch enforced, no apps needed.

Key features

What this lab actually does

Not theory — working infrastructure I use every day.

🛡️

Privacy by design

Dedicated VPN network (VPNNET): every device in it routes 100% through NordVPN. Killswitch prevents leaks. DNS filtered through PiHole — only port 53 leaves the segment.

🌍

Secure remote access

Tailscale mesh: phone and laptop reach lab from anywhere. Subnet routing for full LAN access.

🔒

Hardened authentication

Diceware master passwords (80+ bits entropy). TOTP 2FA. Argon2-hashed admin tokens.

📦

Production-grade ops

Snapshot-based recovery. Volume persistence. Service isolation. Automatic restarts.

Tech Stack

Tools and technologies

The components I configured, broke, and rebuilt to make this work.

Infrastructure

Proxmox VE Debian 12/13 Docker

Networking

OPNsense Suricata IDS WireGuard NordVPN Tailscale PiHole Kea DHCP

Services

Vaultwarden Caddy Crowdsec

Diagnostic tools

tcpdump pfctl curl jq ssh systemd
Lessons Learned

What broke, and why it matters

Theory is clean; practice is messy. These are the moments that taught me more than any tutorial could.

🔥 OPNsense rebuilt three times

Routing through a VPN tunnel requires firewall-based gateways, not changing the default route. Took three full rebuilds to learn this.

🌐 The Tailscale SNAT trick

Exit-node packets were rewritten before reaching firewall rules. Hours of tcpdump debugging led to one checkbox: "Disable SNAT".

🏠 Independence for critical infra

Proxmox host must not depend on PiHole VM for DNS. A circular dependency at boot can ruin your day.

⚠️ Always check before removing kernels

`uname -r` before `apt autoremove`. Removing the running kernel is a one-way trip to an unbootable system.

📋 WARN ≠ ERROR

Caddy's "Caddyfile not formatted" looks scary. It's purely cosmetic. Read log levels carefully before panicking.

📸 Snapshots saved me 15 times

Every nontrivial change got a labeled, dated Proxmox snapshot. Storage is cheap; debugging time is expensive.

💾 "Save" is not "Apply"

Firewall rules were configured perfectly — and inactive. OPNsense stages changes until you hit Apply. 20 minutes of debugging a config that was already right.

🕳️ DNS takes its own path

Traffic in the tunnel ≠ DNS in the tunnel. The leak test showed my real IP while every connection was safely tunneled. Fix: DHCP points at PiHole, firewall allows only port 53.

🛑 A kill switch needs a kill test

When a VPN gateway went down, traffic silently fell back to WAN — real IP exposed. One hidden setting ("Skip rules when gateway is down") made the kill switch actually kill. Trust the test, not the config.

Full details in lessons-learned.md on GitHub.

Want the full story?

Detailed setup guides, anonymized configs, and architecture deep-dives — all on GitHub. Open source, MIT licensed.

📦 View andro-lab on GitHub