Homelab Network Infrastructure

Network Segmentation is the practice of dividing a network into smaller, isolated sections. Why does this matter? If an attacker compromises one device (say, a smart TV), segmentation prevents them from moving laterally to your important systems (like your file server or workstation).

Defense in Depth is a security strategy that uses multiple layers of protection. Instead of relying on a single firewall, you combine:

• Perimeter security - Firewall at the network edge
• Network segmentation - VLANs to isolate traffic
• Access control - Only allow necessary connections
• Monitoring - IDS/IPS to detect threats
• Endpoint security - Antivirus and host firewalls on devices

Least Privilege means giving users and devices only the minimum access they need. Your smart thermostat needs internet access to check weather - it doesn't need to access your file server.

For the exam: These concepts appear on Security+, Network+, and even A+. Understand that defense in depth assumes any single control can fail. Know common segmentation techniques: VLANs, subnets, DMZs (demilitarized zones for public-facing servers), and air gaps (complete physical isolation).

A VLAN (Virtual Local Area Network) is a way to divide one physical network into multiple logical networks. Think of it like an apartment building with separate floors - everyone shares the same building (switch), but people on floor 1 can't just walk into apartments on floor 3 without going through security (the router/firewall).

Without VLANs, every device on your network can "see" every other device - your gaming PC, your smart TV, your security cameras, and your guest's phone are all neighbors. VLANs let you create boundaries so your IoT devices can't snoop on your workstation, and guests can't access your file server.

For the exam: VLANs operate at Layer 2 (Data Link) of the OSI model. Traffic between VLANs requires a Layer 3 device (router or firewall) - this is called inter-VLAN routing. VLAN tagging uses the IEEE 802.1Q standard.

A firewall is a network security device that monitors and controls incoming and outgoing traffic based on security rules. Think of it as a security guard at a building entrance - it checks everyone's credentials and only lets authorized traffic through.

OPNsense is a free, open-source firewall operating system based on FreeBSD. It's an alternative to expensive commercial firewalls like Cisco ASA or Palo Alto. OPNsense provides:

• Stateful packet inspection - Tracks the state of network connections
• NAT (Network Address Translation) - Allows multiple devices to share one public IP
• VPN support - OpenVPN, WireGuard, IPsec for secure remote access
• Traffic shaping - Prioritize important traffic (like video calls over downloads)

For the exam: Know the difference between stateless firewalls (filter packets individually) and stateful firewalls (track connection state). Understand firewall rules work top-to-bottom - the first matching rule wins. Most firewalls use an implicit "deny all" at the end.

An unmanaged switch is plug-and-play - it just forwards traffic between ports with no configuration options. Think of it like a power strip: simple, but no control.

A managed switch gives you control over how traffic flows. You can:

• Configure VLANs - Segment your network logically
• Set up port mirroring (SPAN) - Copy traffic to another port for monitoring
• Enable PoE (Power over Ethernet) - Power devices like cameras and access points through the network cable
• View traffic statistics - See what's happening on your network

For the exam: Managed switches operate at Layer 2 but can have some Layer 3 features. Know that PoE uses IEEE 802.3af (15.4W) and PoE+ uses IEEE 802.3at (25.5W). Port mirroring is essential for network monitoring and IDS deployment.

You'll notice the services below are labeled VM, LXC, or Docker. These represent different virtualization approaches:

Virtual Machines (VMs) - A complete computer simulation with its own operating system, virtual hardware (CPU, RAM, disk, network). VMs are fully isolated but resource-heavy. Use when you need: different operating systems, complete isolation, or legacy software.

LXC Containers - Lightweight Linux containers that share the host's kernel but have isolated filesystems and processes. Uses far fewer resources than VMs but can only run Linux. Think of VMs as separate houses, and containers as apartments sharing utilities.

Docker - Application containers designed to package and run a single application with its dependencies. Docker containers are portable - build once, run anywhere. Popular for microservices and DevOps workflows.

For the exam: VMs use a hypervisor and have their own kernel. Containers share the host kernel, making them faster to start but less isolated. Know that Type 1 hypervisors (Proxmox, ESXi) run on bare metal, while Type 2 (VirtualBox) runs on a host OS.

Pi-hole (DNS Sinkhole) - DNS (Domain Name System) translates human-readable names (google.com) into IP addresses (142.250.80.14). Pi-hole acts as your network's DNS server and blocks requests to known advertising and tracking domains. When an ad tries to load, Pi-hole returns nothing - the ad disappears. This works for your entire network, including devices that can't run ad blockers (smart TVs, IoT devices).

TrueNAS (NAS - Network Attached Storage) - Centralized file storage accessible over the network. Instead of files scattered across different computers, everything lives on one server. TrueNAS uses ZFS, a file system with built-in data protection (checksums to detect corruption, RAID-like redundancy, snapshots for backups).

Twingate (Zero Trust Network Access) - Traditional VPNs give you full network access once connected. Zero Trust assumes the network is already compromised and verifies every access request individually. Users only reach specific resources they're authorized for - not the entire network. This is the modern approach to remote access.

For the exam: Know that DNS uses port 53 (UDP for queries, TCP for zone transfers). Understand NAS vs SAN (SAN presents raw block storage, NAS presents file shares). Zero Trust is a key concept in Security+ - "never trust, always verify."

IDS (Intrusion Detection System) - A passive security system that monitors network traffic and alerts you when it detects suspicious activity. Think of it as a security camera - it watches and records but doesn't physically stop anyone.

IPS (Intrusion Prevention System) - An active security system that not only detects threats but can automatically block them. Think of it as a security guard who can physically stop intruders.

Security Onion is a free Linux distribution that bundles multiple security tools together:

• Suricata/Snort - IDS/IPS engines that analyze traffic patterns
• Zeek (formerly Bro) - Network security monitor for deep traffic analysis
• Elasticsearch/Kibana - Search and visualize security data
• TheHive - Incident response platform

For the exam: Know that IDS/IPS can be network-based (NIDS/NIPS) or host-based (HIDS/HIPS). Signature-based detection matches known attack patterns. Anomaly-based detection learns normal behavior and flags deviations. Understand false positives (alert when nothing is wrong) vs false negatives (missing real attacks).