Homelab Zero Trust Infrastructure

My homelab is a personal infrastructure designed as an experimentation, hosting and learning environment focused on virtualization, networking, security and system administration.

The goal is to maintain an architecture that is close enough to a real-world environment to test different technical approaches, deploy services, simulate network scenarios and apply security principles without relying on professional infrastructure.

The entire environment is built around Proxmox for virtualization and OPNsense as the central point for network and security control.

Objectives

The project has several objectives:

• centralize service virtualization;
• segment different network usages;
• apply a Zero Trust approach;
• precisely control traffic between network zones;
• isolate exposed services;
• maintain a reproducible lab environment;
• test security and monitoring mechanisms;
• keep the personal infrastructure scalable and documented.

General architecture

The infrastructure is based on a Proxmox host running several virtual machines dedicated to different services.

OPNsense is virtualized and acts as the central gateway between the different network zones.

The architecture is designed around several distinct segments, including:

• user network;
• server network;
• IoT network;
• management network;
• dedicated interfaces for WAN connections and different internal uses.

Services are isolated according to their role in order to limit unnecessary communication between zones.

Zero Trust approach

One of the main principles of the infrastructure is a default-deny approach.

Traffic is not globally allowed between the different networks.

Each access is opened only when it is required for a specific use case.

This notably helps to:

• limit lateral movement;
• control communication between users and servers;
• prevent IoT devices from reaching sensitive networks;
• control Internet access for different devices;
• reduce the exposure of internal services.

The rules are enforced through OPNsense and evolve according to the requirements of the applications and services being used.

Network segmentation

Segmentation is used to separate different types of devices and services.

The user network is isolated from the network hosting virtual machines and services.

IoT devices are also isolated so that they can access only the resources required for their operation.

This separation also makes traffic analysis easier and allows security policies to be adapted to each zone.

Virtualization with Proxmox

Proxmox VE is the main virtualization platform.

It hosts different virtual machines dedicated to services, testing and lab environments.

This organization makes it possible to:

• isolate services from each other;
• quickly create new environments;
• test different system configurations;
• manage CPU, memory and storage resources;
• reproduce complete architectures without requiring dedicated physical hardware for every service.

The platform also serves as a foundation for experimenting with different network and security strategies.

Firewall and routing with OPNsense

OPNsense handles routing and filtering between the different network zones.

It centralizes:

• firewall rules;
• routing;
• network segmentation;
• WAN access;
• service publishing rules;
• VPN-related rules;
• filtering and security mechanisms.

The configuration favors explicit and narrowly scoped rules rather than broad permissions.

DNS and NTP

DNS and NTP services are centralized in order to maintain control over name resolution and device time synchronization.

Clients are configured to use internal services instead of directly relying on external services.

This notably makes it possible to:

• reduce DNS bypasses;
• centralize filtering policies;
• manage internal domains;
• resolve locally hosted services;
• control time synchronization across machines.

Unbound is used for DNS resolution.

VPN and remote access

WireGuard is used for VPN connections.

The goal is to provide secure remote access without directly exposing administration services to the Internet.

VPN access can be limited to only the required networks and services in order to preserve the segmentation model used on the local network.

Security and monitoring

The infrastructure integrates several mechanisms designed to strengthen service security.

CrowdSec is used to detect suspicious behavior and share blocking decisions with the relevant components.

Linux systems can also use nftables to apply complementary local filtering.

The goal is to combine several layers of protection:

• centralized network filtering;
• local filtering on hosts;
• suspicious behavior detection;
• reduction of the exposed attack surface;
• service isolation;
• restricted administrative access.

Server hardening

Virtual machines hosting services are configured using a restrictive approach.

Hardening includes:

• SSH key-based authentication;
• password authentication disabled;
• direct root SSH login disabled;
• unnecessary SSH features restricted;
• local network filtering;
• exposure limited to strictly required ports;
• administration allowed only from authorized network zones.

The goal is for each machine to remain protected even if another part of the infrastructure is misconfigured.

IPv4 and IPv6

The infrastructure is designed to operate with IPv4 while also taking IPv6 into account.

Using IPv6 requires particular attention because it does not rely on the same NAT mechanisms traditionally used with IPv4.

Firewall and segmentation rules therefore need to be designed so that IPv6 communication maintains the same level of control as IPv4.

Multi-gigabit network

The physical network uses multi-gigabit links with interconnections capable of reaching 10 Gb/s.

This capacity helps prevent the network from becoming a bottleneck for:

• communication between virtual machines;
• file transfers;
• backups;
• self-hosted services;
• performance testing;
• future infrastructure growth.

Hosted services

The homelab is used to host different personal services and test environments.

Each new service is integrated using the same principles:

• appropriate network placement;
• only strictly necessary traffic allowed;
• internal DNS;
• system hardening;
• monitoring;
• backups when required;
• external exposure only when justified.

Technical challenges

One of the main challenges of the project is maintaining a secure architecture while keeping enough flexibility for experimentation.

An overly permissive policy would make deployments easier but would significantly reduce the security value of the project.

On the other hand, an overly restrictive policy can make some services harder to troubleshoot when their required network flows are not clearly documented.

A significant part of the work therefore consists of identifying the exact communications required by each application and creating only the corresponding rules.

Managing IPv4 and IPv6 simultaneously is another challenge, as both protocols must follow the same segmentation principles without relying on the same mechanisms.

Project evolution

The infrastructure continues to evolve progressively.

Future improvements may include:

• adding new services;
• improving monitoring;
• strengthening incident detection;
• evolving network segmentation;
• adding new dedicated networks;
• improving documentation;
• automating certain operations;
• improving backup and recovery mechanisms.

Personal project

This infrastructure is entirely personal and serves as a technical laboratory.

It allows me to freely experiment with different architectures, configurations and security solutions while maintaining an environment that is actively used on a daily basis.