NETWORK · SECURITY // SELF-HOSTED

Homelab

A segmented home network with VLAN isolation, a SIEM, and a full security monitoring stack, all self-hosted in a 3D-printed server rack.

// OVERVIEW

Built a security-segmented network across a MikroTik RouterOS router, managed switch, Intel N100 server, and Raspberry Pi 5. The setup covers VLAN isolation, firewall policy, intrusion detection, and a SIEM, applying enterprise networking and security concepts hands-on.

// HIGHLIGHTS

›VLAN segmentation: four isolated segments (Management, Servers, Clients, Guest) with least-privilege access; the guest network is internet-only with no lateral movement.
›Security-first design: defense-in-depth firewall rules, SSH key-only authentication, NAT masquerading, and full network isolation between segments.
›Security monitoring & SIEM: Splunk for log indexing and analysis, Prometheus + Grafana dashboards, and Suricata IDS via switch port mirroring.
›Self-hosted services: Pi-hole network-wide DNS filtering, WireGuard VPN, Chrony NTP, centralized rsyslog logging, and Docker-containerized apps.
›High-availability design: critical services (DNS, NTP) run on the Pi and stay up through server reboots and maintenance.
›Fully documented, reproducible runbook for disaster recovery.

// GALLERY