Home Lab Setup & Network Segmentation Project
Part of the Cybersecurity Roadmap
In short
A home lab is your safe practice ground. Building one with proper network segments shows recruiters you understand architecture, not just tools you clicked through once.
Build and document a personal home lab with proper network segmentation — demonstrating hands-on infrastructure and security architecture skills beyond just running tools someone else set up.
Think of it like this
A model house with locked inner doors
Imagine building a model house where the kitchen, bedrooms and store room each have their own lockable door. A guest in the hall cannot wander into the store room. Network segmentation does this: your attacker VM, vulnerable VMs and home devices live in separate rooms.
Watch it happen
Build plan
1/6Install VirtualBox, VMware Workstation or Proxmox on a spare machine with enough RAM.
The big ideas
What you need to know
Vulnerable VMs stay caged
Intentionally weak machines must never reach the internet or your home network. Block that at the firewall.
Default deny
Block traffic between segments by default, then allow only what each exercise needs.
Document like a pro
A diagram, an IP plan and a rules table turn a hobby lab into a portfolio piece.
Snapshots save hours
Take VM snapshots before each exercise, so you can reset a broken target in seconds.
See it in code
Walk through the code
1# Segment plan (put this in your README)2HOME 10.0.10.0/24 laptop, phone3LAB-ATTACK 10.0.20.0/24 Kali VM4LAB-VULN 10.0.30.0/24 Metasploitable, DVWA5MGMT 10.0.99.0/24 firewall UI, Wazuh6 7# Firewall rules (first match wins)8LAB-ATTACK -> LAB-VULN allow9LAB-VULN -> any deny # no internet, no home LAN10LAB-* -> HOME deny11HOME -> MGMT:443 allow12any -> MGMT deny1/3Each segment gets its own subnet and a short list of what lives there.
A clear segment plan and rule table, written before you click anything. Recruiters love seeing the thinking, not just the screenshots.
Save yourself the pain
Common mistakes
Oops
Running vulnerable VMs in bridged mode on your home Wi-Fi.
Do this instead
Use internal or host only networks behind a firewall VM, so weak machines cannot be reached from outside.
Oops
Building the lab with no notes and forgetting how it works a month later.
Do this instead
Keep a README with the diagram, IP plan, rules and rebuild steps from day one.
Your mission
First milestone: two segments
Quick check
Why must the vulnerable target segment be blocked from the internet?
Go deeper
- 1Set up a home lab with at least 2-3 VMs on a segmented, isolated network.
- 2Document your network design and the security reasoning behind your segmentation choices.
- 3Write up how you'd detect and respond to a simulated compromise in this environment.
More projects at this stop
CTF (Capture the Flag) Writeups
Vulnerability Assessment Report
Security Automation Script Project
SIEM Dashboard & Detection Rules Project
Incident Response Tabletop Writeup
Portfolio Website or GitHub Showcase
Stuck on this topic? Ask an Insider
Get 1:1 guidance from people who've walked this exact path — on the InsideEdge app.
