Segmented Proxmox Homelab
One Proxmox host runs workloads at different trust levels: development, internal services, public-facing services, and a security lab for malware and offensive tooling. Each is isolated in its own network segment behind a firewall, with no path between segments except by explicit rule.
Network segmentation
The firewall is an OPNsense VM. The host has a single NIC and the router has no VLANs, so each segment is a Linux bridge with no uplink, attached only to OPNsense, which routes and filters between them.
| Segment | Contents | Internet |
|---|---|---|
| Development | Development environment | Yes |
| Internal | Isolated VMs on an encrypted dataset | Yes |
| Shared | Public-facing services | Yes |
| Lab | Attack tooling, vulnerable targets, GPU compute | No |
| Monitoring | SIEM and log collection | Yes |
Segments are isolated at every layer: separate bridge, ZFS dataset, Proxmox pool, and firewall policy. The lab has no route off its bridge. Same-bridge traffic never reaches OPNsense, so intra-lab isolation is enforced by per-VM firewall rules on each guest NIC, preventing a compromised target from reaching another. The policy set is verified by a harness that drives a probe and target through every segment pair and asserts each path, and it reruns after any firewall change.
Storage and encryption
Guest disks are on a ZFS mirror, one dataset per segment. The internal dataset is encrypted (aes-256-gcm) and unlocked manually after boot; its guests will not start until it is. Disks are thin-provisioned and the pool is kept under 80 percent.
Remote access
No ports are exposed and there is no inbound path from the internet. Access is a WireGuard mesh (Tailscale) split into separate tailnets so contexts never share a trust boundary. The lab and SIEM are reached through a subnet router rather than given their own internet. ACLs are scoped per tailnet, and infrastructure nodes are tagged so they cannot initiate into the mesh.
Monitoring
Wazuh (manager, OpenSearch, dashboard) collects from an agent on every guest and from OPNsense over syslog. It does file integrity monitoring, vulnerability detection, and MITRE ATT&CK mapping. Agent enrollment is password-gated, so a compromised lab host cannot register spurious agents. The lab exercises detection directly: run an attack, confirm the alert, tune the rule or log source when it misses.
Backups
A mirror only covers a dead disk. Proxmox Backup Server writes deduplicated backups to NFS on a separate NAS, one namespace per segment. Its token can create and restore but not delete, so a compromised host cannot purge its own history. The NAS keeps daily immutable snapshots, unremovable for a week, as the ransomware backstop. Prune, GC, and verification run from persistent timers that catch up after downtime. Restores are tested by recovering a guest into an isolated copy and booting it.
Infrastructure as code
The encrypted segment’s guests are defined in Terraform (bpg/proxmox) against a least-privilege API token, reproducible from the definition and treated as disposable. The segment is not backed up because the code is the source of truth.
GPU compute
The host shares the AMD GPU’s render and compute device nodes into containers rather than passing the whole card to one VM, which would bind it to that guest and can trip the Navi reset bug. Two workloads use it, one over OpenCL and one over ROCm, with one heavy job at a time.
Availability
The host is powered off when idle and woken over the network on demand. Guests do not start on boot, and missed scheduled maintenance runs at the next boot.