Homekie**er's homelab journal

My homelab started with a Minecraft server for my friends.

I built it so me and my friends can play Minecraft.

Read how it startedOpen the lab console

I use sample logs and substituted names, DNS records, addresses, and ports to protect the identity of my lab and the people who use it. Example alerts and triage decisions illustrate the workflow.

lab Topology

Simulated telemetry · substituted names and addresses 7 Nov 2026 · 00:00 to 24:00 UTC

Guests
13 8 running
DNS queries
4,164 22.5% blocked
Endpoints
3 Windows
SIEM alerts
24 9 high
Cases
4 3 open

Select a service to see what it does.

Proxmox VE · the laptopLAN bridgevmbr1 · untagged LANVLAN trunkvmbr2 · Port3 · 7 VLANsWindows identityAD lab and endpointsSOC stackSOCFortress referencePublic readerany browserCloudflare WAFWAF + tunnelWANISP, behind CGNATRemote laptopenrolled clientLaptop uplinkonboard NICWAN bridgevmbr0Sophos FirewallVM 102LAN bridgevmbr1 · untaggedVLAN trunkvmbr2 · VLAN-awareTwingateLXC 208Proxmox UITCP 8006NetBirdLXC 204NextDNSLXC 209MinecraftLXC 207CF TunnelLXC 203BunkerWebLXC 2065 · MGMT20 · LAB_TEST40 · SOC50 · DMZActive DirectoryAD DS + GPOWindows clientsdomain-joinedDefenderendpoint sensor …Kali Red/BlueVM 301 · 302Wazuhdetection layerCoPilotSOC workspaceGrayloglog pipelineSplunksecond SIEM viewProxmox VE · the laptopLAN bridgevmbr1 · untagged LANVLAN trunkvmbr2 · Port3 · 7 VLANsWindows identityAD lab and endpointsSOC stackSOCFortress referencePublic readerany browserCloudflare WAFWAF + tunnelWANISP, behind CGNATRemote laptopenrolled clientLaptop uplinkonboard NICWAN bridgevmbr0Sophos FirewallVM 102LAN bridgevmbr1 · untaggedVLAN trunkvmbr2 · VLAN-awareTwingateLXC 208Proxmox UITCP 8006NetBirdLXC 204NextDNSLXC 209MinecraftLXC 207CF TunnelLXC 203BunkerWebLXC 2065 · MGMT20 · LAB_TEST40 · SOC50 · DMZActive DirectoryAD DS + GPOWindows clientsdomain-joinedDefenderendpoint sensor …Kali Red/BlueVM 301 · 302Wazuhdetection layerCoPilotSOC workspaceGrayloglog pipelineSplunksecond SIEM view
  • Running
  • Stopped
  • Configured
  • In use
  • Reference stack
  • Example

Tracing packet flow

Outside traffic reaches the WAN bridge, crosses Sophos, and leaves on the LAN bridge. Hosts on the same bridge can talk without crossing Sophos. From my lab record

Identity and access

Deciding who gets in, and checking it afterwards

Most of my lab questions end up as identity questions: which account did this, which group allowed it, and which policy should have stopped it. This is the part of the lab I have spent the most time on. Each card links to the entry that shows the work.

Example layout · names are illustrative

  • lab.exampledomain root
    • Lab Usersdaily accounts
    • Lab Adminsseparate admin accounts, tiered
    • Lab Computers
      • Workstationsdomain-joined clients
      • Serversfile server, member servers
    • Service Accountsno interactive logon

Group Policy objects

Linked to Lab Computers: turns on logon and account-management auditing for workstations and servers below it.

Pick a GPO to see which OUs it reaches. Names are illustrative, not my real domain.

  • Users, groups and OUs

    Daily and admin accounts are separate objects in separate OUs. Access goes to groups, never to a person, so removing someone from a group removes the access everywhere. A nested helpdesk group is the line I check first in a membership review.

    Example namesAccounts and groups in my AD lab

  • Group Policy scope

    A GPO reaches everything under the OU it is linked to. When a setting is missing on a machine, I read gpresult on that machine before I touch the domain controller: the distinguished name usually answers it.

    Example outputGPO scope and gpresult

  • Windows auditing

    Audit policy decides which events exist at all. I turned on logon and account-management auditing for lab computers, then read one failed logon (4625) field by field to see what the alert leaves out.

    Worked exampleReading a failed logon, field by field

  • Access troubleshooting

    For a locked account I check 4740 for where the lockout came from and 4625 for the failures behind it, then the lockout policy, before resetting anything. The worked example traces one lab user locked out from one workstation.

    Worked exampleA lockout traced back to its source

  • Twingate resource access

    Twingate starts from the user: a signed-in person asks for a named Resource, and the groups granted to it decide whether a route exists. In my lab the Proxmox and Sophos web UIs are Resources granted to one admin group.

    From my lab recordWho can reach what

  • NetBird policy and routing

    NetBird starts from the device: peers in groups, and policies between groups. A routing peer forwards to networks behind it. The default allow-all policy is disabled in my setup, so only TCP 8006 and 4444 are allowed and a failed ping is expected.

    From my lab recordTwo private paths, compared

How the lab began

Hosting Minecraft behind CGNAT for five friends

My friends and I play on a vanilla Java Edition 26.3 server in its own container, LXC 207, which I run from Crafty Controller. My home internet sits behind carrier-grade NAT, so I can't forward a port in. My friends connect to a public VPS instead, and WireGuard carries the game back to the lab. One Cloudflare SRV record gives them a single name to type.

The scanners taught me the rest. Moving the port only made my log quieter; the whitelist, withonline-mode on, is what decides who gets in. Flip Before and After below to see what changed.

Read the Minecraft case studyHow the rest of the lab grew
Minecraft for five friendsLXC 207 · Java Edition 26.3
Cloudflare DNSSRV + A, DNS onlyInternet scannerscommon portsFriend's clientjoins by nameVPS edge203.0.113.24WireGuardtunnel to the labLXC 207Crafty + serverWhitelist + sign-in:25565 answered:25565 closedCloudflare DNSSRV + A recordsScannerscommon portsFriend's clientjoins by nameVPS edge203.0.113.24WireGuardtunnel to the labLXC 207Crafty + serverWhitelist + sign-in:25565 answered:25565 closed
Port
28565 (example)
Whitelist
on: five named friends
Joining
one name, found by an SRV record
Scan noise
quieter; the port is not a control

Examples for privacy: the VPS IP, player names, hostname, SRV record and port are substituted

Cloudflare only answers the DNS lookup here; game traffic goes to the VPS. The journal’s own Cloudflare Tunnel is a separate path.

  • dig +short SRV _minecraft._tcp.play.example.net
dig +short mc-edge.example.net
    0 5 28565 mc-edge.example.net.
203.0.113.24

    The SRV answer carries the port and a target name; the target name resolves to the edge address.

    Example output

  • whitelist on
whitelist list
    Whitelist is now turned on
There are 5 whitelisted players: friend-a, friend-b, friend-c, friend-d, friend-e

    The whitelist is the control. An account not on this list is refused even if it finds the port.

    Example output

  • grep -E '^(server-port|white-list|enforce-whitelist)=' server.properties
    server-port=28565
white-list=true
enforce-whitelist=true

    enforce-whitelist also removes anyone already online who is not on the list when it is reloaded. The list matches accounts, so account sign-in checks are part of the same control.

    Example output

  • nc -vz -w 3 mc-edge.example.net 25565
nc -vz -w 3 mc-edge.example.net 28565
    nc: connect to mc-edge.example.net port 25565 (tcp) timed out
Connection to mc-edge.example.net 28565 port [tcp/*] succeeded!

    Run from a laptop off the home network, so the test takes the same path a friend does.

    Example output

What runs in the lab

  • Sophos FirewallVM 102Running
  • Proxmox VEhypervisor on the laptopConfigured
  • Active DirectoryAD DS + GPOIn use
  • TwingateLXC 208Running
  • NetBirdLXC 204Running
  • NextDNSLXC 209Running
  • Cloudflare TunnelLXC 203Running
  • Wazuhdetection layerReference stack
  • SOCFortress CoPilotSOC workspaceReference stack
  • Splunksecond SIEM viewIn use
  • Defender for Endpointendpoint sensor · trialIn use
  • Kali Red / BlueVM 301 · 302Stopped
  • MinecraftLXC 207Running
  • DMZ · journalCT 410Running

Product names and logos are trademarks of their owners and appear only to name the tools I use. Sophos, Wazuh, Twingate, NetBird, SOCFortress CoPilot, Defender for Endpoint and Minecraft are shown with named line icons because no permitted logo was available.

For internship reviewers

What I can do, grouped the way job postings ask

Five capability groups. Under each, a line on what entry-level postings asked for in November 2026, then the skills I used and the entry that shows it. The rating is my own four-step scale, not a percentage or a certification.

  1. ExploredI have read about it and tried it once.
  2. PracticedI have used it on example data or a practice exercise.
  3. AppliedI have used it in my lab for a real job.
  4. Can troubleshoot and explainI can find a fault in it and explain the cause.

Network and IT operations

Postings ask for TCP/IP, routing, NAT, firewalls and VPNs, plus basic Linux.

Identity administration

Postings ask for Working familiarity with Active Directory, accounts and access requests.

SOC investigation

Postings ask for First-level triage of SIEM and EDR alerts, escalation notes, MITRE ATT&CK.

Authorized penetration testing

Postings ask for Hands-on practice through labs or CTFs, and knowing what an attack leaves behind.

Automation

Postings ask for Scripting to save repeated work, usually Bash, PowerShell or Python.

Journal entries, by the question each one answers

Thesis

Using the same lab for my thesis

The thesis environment sits in the LAB_TEST VLAN, cut off from the internet and from my management network. The work is in progress; notes go up when they are ready to share.

Open the thesis notebook