Lab 1 – Proxmox Validation & Segregation Prep

This lab assumes Proxmox VE is already installed and configured. You will verify host health, create internal bridges for your homelab networks, and confirm that one existing VM remains isolated on the management bridge (vmbr0).

• Outcome 1: Confirm Proxmox host stability and update status.
• Outcome 2: Create internal bridges for lab and security networks.
• Outcome 3: Verify segregation between management and lab networks.
• Outcome 4: Document network layout and exclusions.

• DL1.1: Verified Proxmox host health and updates applied.
• DL1.2: Internal bridges vmbr10 and vmbr20 created.
• DL1.3: Existing VM confirmed on vmbr0 only.
• DL1.4: Isolation verified between management and lab networks.
• DL1.5: Network diagram saved and documented.

1. Log into the Proxmox web UI at https://<proxmox-ip>:8006.
2. Check Datacenter → Node → Summary for CPU, RAM, and disk usage.
3. Run updates:

   apt update && apt dist-upgrade -y

4. Reboot if a new kernel was installed.
5. Confirm uptime and that all storage pools (local, local-lvm) are online.

1. In Datacenter → Node → VMs, locate the existing VM that must remain outside the homelab.
2. Note its name, ID, and network interface.
3. Ensure its NIC is attached to vmbr0 (management/ISP LAN).
4. Add a comment in Options → Notes:

   Excluded from homelab network — remains on management bridge.

1. Navigate to Node → Network → Create → Linux Bridge.
2. Add:
   • vmbr10 — Lab LAN (no physical NIC, no IP).
   • vmbr20 — Security subnet (no physical NIC, no IP).
3. Apply changes and reboot if prompted.
4. Verify bridges appear in the network list.

1. Create a temporary test VM (e.g., Ubuntu Server) attached to vmbr10.
2. Confirm it receives no DHCP from your ISP router (expected).
3. Confirm it cannot reach the internet (expected until OPNsense is added).
4. Confirm the existing VM on vmbr0 cannot ping the test VM on vmbr10.
5. Delete the test VM after verification.

1. Use draw.io or Excalidraw to sketch your network layout.
2. Include:
   • ISP router → Proxmox host → existing VM (on vmbr0).
   • Planned OPNsense VM bridging vmbr0 (WAN) and vmbr10 (LAN).
   • Future lab and security subnets (vmbr10, vmbr20).
3. Save the diagram as lab1-network-segregation.png in your docs/ folder.
4. Record all bridge names, IP ranges, and VM exclusions in your lab notes.

• Conceptual: The role of network segregation in protecting your management environment from lab experiments.
• Operational: How to create and verify internal bridges in Proxmox.
• Design: How to isolate existing VMs from new homelab networks while maintaining management access.

You now have a validated Proxmox environment with clear segregation boundaries. The existing VM remains safely outside the homelab network, and your new internal bridges are ready for OPNsense deployment in Week 2.