Building a Multi-Host Home Lab: AD, pfSense, and Tailscale

[Editor's note: replace with your own story — what you started with, what hardware you're running on, and why you kept expanding it.]

Architecture Overview

The lab runs as a multi-host environment virtualized with KVM/QEMU, with OpenMediaVault providing centralized storage (NAS) for VM images, backups, and shared data. Networking is split across two layers: a pfSense box handles routing, firewall rules, and VLAN segmentation between the lab network and the rest of the home network, while Tailscale provides a mesh overlay so I can reach lab hosts securely from outside without opening inbound ports.

A dedicated Active Directory domain controller runs inside the lab, which lets me practice the same Group Policy, account management, and authentication concepts I support professionally at Bay Tech Team's AD environment.

Why Segmentation Mattered

It was important for me to completely isolate this network from the rest of my home network. In the event that something in my lab had gone wrong, I did not want to cause any issues on my home network at all, so sandboxing was required.

As for the sandbox lab itself, I used a pfSense router to best replicate what a production environment would be like for network and system administrators. I learned about creating VLANs, firewall rules, port forwarding, and so much more.

On the personal use side of this homelab, I kept it seperate from the rest of the lab, and I am only able to connect in through my Tailscale tunnel. This keeps me secure, as I don't have to port forward on my home network, exposing me to a potential vulnerability. Tailscale seemed almost magic to me when I first began using it, and I am sure that I will continue to use it for a long time.

Lessons Learned

• I learned how convenient Tailscale is. It was a super simple setup, and now I have it in multiple locations, and almost every device that I own.
• When configuring my server, I ran into issues with reliability. Specifically, it was at home while I was at my apartment at school. It was important for me to keep one server at home so that I had access to the local blacked-out Ravens games, as well as to keep my access to Netflix and YoutubeTV. My solution was to install a server management dashboard and invest in a UPS. That way, any accidental outage would be resolved by the UPS, and I could spin up or shut down VMs on the fly from my virtual console, all while sitting over an hour away in Pennsylvania.

What's Next

I'd like to rerun the entire sandbox lab. I'll be implementing a SIEM of some sort, such as SecurityOnion. My goal will be to attack the lab, monitor an attack occurring, and properly mitigate the attack. I'll also be adding a vulnerability scanner like OpenVAS and centralized logging.