Last year I created a homelab using VirtualBox as my lab platform, which allowed me to experiment with creating an enterprise style network at home. The issue that I ran into pretty quickly was that my base system started having trouble keeping up once I added more and more tools onto my network stack. The computer I used was no slouch, powered by a Ryzen 7900X and 32GB of DDR5 RAM, but the amount of virtual machines I was attempting to use at once made it impossible for the performance of all the machines to hold up. I think one of the biggest bottlenecks was having most of the VMs share one SSD, as Wazuh most likely locked up the drive with the amount of reads and writes that had to happen continuously. Having learned from my mistakes, I decided to rebuild the homelab with a more efficient architecture to ensure that the bottlenecks I experienced last time don’t happen again.
Hardware
Funnily enough the hardware for this build is actually a significant downgrade from my previous attempt. The last computer I used was my personal desktop machine, but I realized during testing last year that running everything on one box made it extremely slow to get real work done. I remember during a pentest one day that my Windows Server VM kept locking up and the Wazuh dashboard would frequently hang, which made it really difficult to verify that my attacks were actually being seen by the XDR. The easiest way to prevent this issue from happening is to simply separate the functions to different machines: Work can be done by me from my laptop or desktop, while a headless server runs on my network with different containers running my tools. The server I’m using is an old Acer Aspire tower PC that got me through high school, with a cool Intel Core i5-7400 (yes, I know this is old and weak) along with 16GB DDR4 RAM. The bottleneck I immediately identified was the virtual core count, as this CPU only holds 4 cores with no hyperthreading. This could become problematic when running many different VMs and containers, so I popped over to eBay and bought a Core i7-7700, which has 4 cores and 8 threads. Since this CPU has hyperthreading enabled, I effectively doubled my core count for $40.
Storage was another concern that I had in my last attempt, as I had experienced performance bottlenecks from using one drive. To mitigate this problem, I decided to use 6 drives for this build: one 128GB M.2 SSD acts as the boot drive, one 2TB HDD holds long term storage and regular backups, and four 512GB SSDs act as my primary storage pool. The four SSDs that act as my main storage pool are connected with a PCIe drive expansion card, and are running as a ZFS RAIDZ pool. This config has one drive acting as parity, so the total capacity of this pool is 1.5TB with one drive failure being survivable. While I could have mirrored the drives and had a total capacity of 1TB, I wanted to prioritize storage capacity over drive redundancy.
Hypervisor
My last attempt made it clear that VirtualBox was not a sustainable platform to build a large scale lab on. It definitely has some good use cases, and was how I started practicing pentesting and playing with Linux before switching my home computers to Ubuntu, but the resource usage was too significant for the scale I was targeting. I built this lab using Proxmox VE, which I believe is the homelab platform of choice for most people. The huge advantage this gives me is the ability to run many lightweight containers on one system without a huge performance penalty, along with centralized management of my containers in one place.
Architecture
Since my goal with this lab is to run many different applications as efficiently as possible, my focus was largely on containerization instead of running full virtual machines. To facilitate this, I have an LXC container that acts as a Docker host that holds most of my applications. Since these applications run off of the Docker engine, it is possible to run many different applications in one LXC container with minimal resource usage. The only full virtual machine that I am running is an Ubuntu Server 24.04 LTS machine that is hosting Wazuh – my XDR platform. This virtual machine has half of the system resources allocated to it (4 CPU cores and 8GB RAM) to ensure that it is able to reliably capture events from the various devices across my network.
Current Projects
The biggest project that I have been working on within my lab is implementing single sign-on (SSO) using Authentik – I’ll have a more in-depth write-up available once I complete this. So far I have been able to implement SSO within Wazuh, but I need to continue working through the remaining applications when time allows. Some of the other projects I’m looking into include activating a trial license of Splunk Enterprise and working through their Boss of the SOC (BOTS) datasets that they have publicly available, as well as making future pentests more realistic by enforcing Wazuh’s active defense module on vulnerable systems to simulate the defense an EDR solution would provide. I’m really excited for the opportunities that this lab will provide, and I’ll share more once I get these projects underway.