HOME SOC LAB // INFRASTRUCTURE & ARCHITECTURE
Lab Infrastructure & Technical Case Studies
A deep dive into the virtualized and physical engineering of a segmented home SOC lab, defense-in-depth networking, and enterprise identity architecture.
Network Segmentation Matrix (5-VLAN Fabric)
Strict Layer 2/3 network segmentation isolating management interfaces, core domain controllers, testing environments, and untrusted IoT devices.
VLAN 10 // Management
10.10.10.0/24 · Core infrastructure management, Proxmox GUI, switch management interfaces. Restricted to secure admin jumpbox.
VLAN 20 // Core Servers
10.10.20.0/24 · Windows Domain Controller, DNS, TrueNAS storage, internal production services. Strict inter-VLAN inspection.
VLAN 30 // Security Lab
10.10.30.0/24 · Dedicated vulnerable VMs, Security Onion sensor, Kali testing station. Isolated from all production subnets.
VLAN 40 // IoT Quarantine
10.10.40.0/24 · Smart devices, cameras, printers. Internet-only outbound access with zero lateral traversal permitted.
VLAN 50 // Untrusted / Guest
10.10.50.0/24 · Isolated guest network with client-to-client isolation and bandwidth throttling rules.
Physical Hardware & Hypervisor Architecture
Multi-tier bare-metal compute and storage cluster running dedicated virtualized network functions with strict resource reservations.
NODE 01 // PERIMETER SECURITY GATEWAY
OPNsense High-Availability Appliance
Quad 2.5GbE Intel i226-V network appliance running OPNsense 24.7 with Suricata IDS/IPS, Unbound DNS-over-TLS, and automated geo-IP blocking.
Intel Celeron N5105 · 16GB DDR4 · Dual M.2 NVMe RAID-1 · Dedicated L2/L3 Trunk
NODE 02 // VIRTUALIZATION & COMPUTE
Proxmox VE Cluster Host (MS-01)
High-density compute node hosting Security Onion SIEM, Kali threat emulation VMs, Wazuh server, and Windows Server Active Directory labs.
Intel Core i9-13900H (14C/20T) · 64GB DDR5 5200MHz · Dual 10GbE SFP+ DAC · 4TB NVMe ZFS
NODE 03 // HYBRID DIRECTORY & IDENTITY
Active Directory Domain Controller (DC01)
Tier 0 domain controller synchronized with Microsoft Entra ID via Entra Connect. Enforces Kerberos hardening, Group Policy baselines, and Intune enrollment.
Windows Server 2022 Datacenter · 4 vCPU · 16GB ECC RAM · Static IP 10.10.20.10 (VLAN 20)
NODE 04 // STORAGE FABRIC & TELEMETRY
TrueNAS CORE ZFS Storage Pool
Enterprise ZFS storage array delivering NFS and SMB datastores for Proxmox backups, Wireshark packet capture archives, and automated offsite snapshots.
Custom 8-Bay TrueNAS · 48TB RAW (RAID-Z2) · 32GB ECC RAM · 10GbE Direct Attach
Interactive Threat Emulation & Packet Simulator
Simulated live operational telemetry demonstrating zero lateral transit across VLAN boundaries and Active Directory defense-in-depth.
● ● ● bash — robluis@soc-analyst: ~
OPNSENSE STATE: ENFORCING // ZERO LATERAL TRANSIT
$ nmap -sS -sV -T4 10.10.30.0/24 — VLAN 30 Security Subnet Audit
Starting Nmap 7.94 ( https://nmap.org ) at 2026-11-14 08:30 MST
Nmap scan report for sec-onion.lab (10.10.30.15)
Host is up (0.00042s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.6
443/tcp open ssl/http nginx 1.18.0 (Security Onion Console)
Nmap scan report for proxmox-node1.lab (10.10.30.10)
PORT STATE SERVICE VERSION
8006/tcp open ssl/http Proxmox Virtual Environment Web GUI
Nmap done: 256 IP addresses (4 hosts up) scanned in 2.14 seconds — [PASS: Zero rogue listeners identified]
$ suricata -r /var/log/suricata/eve.json — VLAN 40 IoT Intrusion Rule Test
[1:2010935:3] ET POLICY Suspicious Outbound SMB Traffic To Non-Standard Subnet
11/14-08:31:02.411 [**] [10.10.40.102:49152 -> 198.51.100.4:445]
[Action: DROP (OPNsense Strict Isolation Rule 4001)]
[VERIFIED] Stateful VLAN 40 IoT Quarantine confirmed. Zero lateral transit permitted into VLAN 10/20/30.
$ powershell.exe -File Invoke-ADZeroTrustAudit.ps1 — Identity Governance Posture
[+] Active Directory Domain: corp.robluis.local (DC01.corp.robluis.local)
[*] Checking Tier 0 Administrative Accounts: PASS (No Tier 1/2 logon rights)
[*] Checking Kerberos Pre-Authentication: PASS (All accounts enforced)
[*] Checking Entra ID Connect Health: OPERATIONAL (Sync delta: 118s)
[AUDIT RESULT: 0 Critical Vulnerabilities / 100% NIST CSF & Security+ Alignment]
Flagship Technical Case Studies
NETWORK ARCHITECTURE
Multi-VLAN Enterprise Network & OPNsense Firewall
Architected a strict 5-VLAN network topology with inter-VLAN firewall rules, GeoIP blocking, and Suricata IDS/IPS. Configured dual-WAN failover and DNS-over-TLS with automated packet logging pipelines.
OPNsense · Proxmox · Suricata · VLANs · Wireshark
IDENTITY & DIRECTORY
Hybrid Active Directory & Entra ID Endpoint Lab
Engineered a full Windows Server 2022 Active Directory environment integrated with Microsoft Entra ID via Entra Connect. Enforced Group Policy baselines, Kerberos hardening, and Intune enrollment.
Active Directory · Entra ID · Intune · Windows Server 2022
GOVERNANCE & GRC
Enterprise Data Classification & NIST CSF Gap Analysis
Authoring a 4-tier data classification policy standard mapped to NIST CSF and CompTIA Security+. Performed gap analysis on hypothetical medical tech company infrastructure, identifying 14 critical control deficiencies.
NIST CSF · CompTIA Security+ · Data Classification · GRC
AUTOMATION & SCRIPTING
PowerShell & Python Identity Automation Engine
Developed automation scripts in PowerShell and Python for user provisioning, group membership auditing, and Tier 1/2 service desk ticket triage, reducing repetitive manual operations by 70%.
PowerShell · Python · Microsoft Graph API · Automation
OPERATIONS LEADERSHIP
USASOC Global Logistics & High-Value Asset Management
13-year logistics and operations career in USASOC. Directed mission-critical equipment staging, security-cleared property tracking, and accountability across 4 continents and 26 nations under zero-fail standards.
USASOC · Operations Leadership · Asset Control · 26 Nations
THREAT DETECTION & SOC
Virtual SOC Deployment with Wazuh & Suricata IDS
Deployed Wazuh XDR and Security Onion within Proxmox VE. Configured Sysmon endpoint forwarders, Suricata network sensors, and custom rule alerts for lateral movement detection.
Wazuh · Security Onion · Sysmon · SIEM · Threat Hunting
Ready to Discuss Infrastructure & Security?
Interested in diving deeper into network architecture, homelab telemetry, or security engineering methodologies?
Get in Touch