🛡️ My Cybersecurity Lab

Defense in depth,
built from scratch.

A multi-layer cybersecurity homelab combining OPNsense, NordVPN, PiHole, Tailscale, and Vaultwarden. From CNC machinist to cybersecurity engineer — this is my journey, documented in code and configs.

📦 View on GitHub → Explore architecture

Architecture

Five layers of defense

Each layer protects independently. If one fails, the others continue defending. This is the essence of defense in depth — and the principle this lab is built around.

NordVPN

Hides home IP, encrypts traffic to the internet via WireGuard tunnel.

OPNsense Firewall

Killswitch, stateful filtering, network segmentation. Configured by hand.

PiHole

DNS-level ad-blocking, tracker blocking, malware domain filtering.

Tailscale

Zero-trust mesh VPN. Devices identify cryptographically — no shared passwords.

HTTPS + Crowdsec

Application-layer TLS encryption with brute-force protection.

Key features

What this lab actually does

Not theory — working infrastructure I use every day.

🛡️

Privacy by design

All LAN traffic flows through NordVPN. Killswitch prevents leaks. DNS filtered through PiHole.

🌍

Secure remote access

Tailscale mesh: phone and laptop reach lab from anywhere. Subnet routing for full LAN access.

🔒

Hardened authentication

Diceware master passwords (80+ bits entropy). TOTP 2FA. Argon2-hashed admin tokens.

📦

Production-grade ops

Snapshot-based recovery. Volume persistence. Service isolation. Automatic restarts.

Tech Stack

Tools and technologies

The components I configured, broke, and rebuilt to make this work.

Infrastructure

Proxmox VE Debian 12/13 Docker

Networking

OPNsense WireGuard NordVPN Tailscale PiHole Kea DHCP

Services

Vaultwarden Caddy Crowdsec

Diagnostic Tools

tcpdump pfctl curl jq ssh systemd

Lessons Learned

What broke, and why it matters

Theory is clean; practice is messy. These are the moments that taught me more than any tutorial could.

🔥 OPNsense rebuilt three times

Routing through a VPN tunnel requires firewall-based gateways, not changing the default route. Took three full rebuilds to learn this.

🌐 The Tailscale SNAT trick

Exit-node packets were rewritten before reaching firewall rules. Hours of tcpdump debugging led to one checkbox: "Disable SNAT".

🏠 Independence for critical infra

Proxmox host must not depend on PiHole VM for DNS. A circular dependency at boot can ruin your day.

⚠️ Always check before removing kernels

`uname -r` before `apt autoremove`. Removing the running kernel is a one-way trip to an unbootable system.

📋 WARN ≠ ERROR

Caddy's "Caddyfile not formatted" looks scary. It's purely cosmetic. Read log levels carefully before panicking.

📸 Snapshots saved me 15 times

Every nontrivial change got a labeled, dated Proxmox snapshot. Storage is cheap; debugging time is expensive.

Full details in lessons-learned.md on GitHub.

Defense in depth, built from scratch.