Building a Certification Homelab — Part 1: Proxmox and the Network+ Lab

Why a ThinkPad?

If you've read my post on repurposing ThinkPads for homelab work, you already know why these machines punch above their weight for this kind of project. The P14s specifically hits a sweet spot for cert labs: the Ryzen 5850U has 8 cores and 16 threads — enough to run 6–8 VMs simultaneously without breaking a sweat — and it can be configured with up to 48GB of RAM, which is genuinely generous for a portable machine. It's also silent, power-efficient, and fits in a bag.

More importantly, running your cert lab on a repurposed ThinkPad mirrors a real constraint you'll face in IT: making the most of the hardware you have, not the hardware you wish you had.

What This Guide Covers

This is Part 1 of a two-part series. By the end of this part you'll have:

• Proxmox VE installed and running on bare metal
• A virtual network architecture with isolated bridges
• A fully functional pfSense router and firewall VM
• DHCP and DNS running via a Pi-hole container
• VLANs configured and tested
• Basic OSPF routing between containers

Part 2 covers the Security+ lab — Security Onion, Kali Linux, Metasploitable, Active Directory, and vulnerability scanning.

Part 1 — The Big Picture

What Is a Hypervisor?

Before touching any software, it helps to understand what you're building.

A hypervisor is software that lets one physical machine run many virtual machines (VMs) simultaneously. Think of your ThinkPad as a building, and the hypervisor as the landlord who divides it into separate apartments — each VM gets its own CPU slice, RAM, storage, and network interfaces, completely isolated from the others.

There are two types:

For a serious lab, Type 1 is the right choice. It's faster, more efficient, and mirrors what you'll see in real enterprise environments. When you sit down to a server in a data center, it's almost certainly running a Type 1 hypervisor — not Windows or macOS with VirtualBox on top.

Why Proxmox specifically? Proxmox VE is free, open source, Debian Linux-based, and has a polished web interface that makes VM management genuinely straightforward. It supports both full VMs and lightweight LXC containers, and it has strong community documentation. For a home lab it's the obvious choice.

Lab Architecture Overview

Here's how all the pieces fit together once everything is running:

+------------------------------------------------------------------+
|         ThinkPad P14s - Physical Hardware (bare metal)           |
+------------------------------------------------------------------+
|              Proxmox VE 8 - Type 1 Hypervisor                    |
|         Web UI at https://192.168.x.x:8006                       |
+---------------------+--------------------+-----------------------+
|    Network+ Lab     |   Security+ Lab    |    Future Labs        |
|                     |                    |                       |
|  * pfSense VM       |  * Security Onion  |  * Ubuntu / Rocky     |
|  * VLANs            |  * Kali Linux      |  * Windows Server     |
|  * DHCP/DNS CT      |  * Metasploitable  |  * k3s (Kubernetes)   |
|  * Routing nodes    |  * Windows AD      |  * LocalStack (AWS)   |
+---------------------+--------------------+-----------------------+

The key insight here is that you're building one platform that supports all your cert labs, not separate environments for each cert. Every VM and container you add lives on the same Proxmox host and shares the same physical resources. This mirrors how real data centers work.

Resource Budget

The P14s with 48GB of RAM is genuinely generous for this purpose. Here's a sensible allocation that leaves headroom for snapshots and experiments:

Running with less RAM? The lab is still viable at 16–32GB — you'll just need to run the Network+ and Security+ labs separately and skip Security Onion in evaluation mode (it needs 16GB minimum). At 16GB, focus on pfSense, Kali, and Metasploitable first and add Security Onion when you upgrade.

Part 2 — Installing Proxmox VE

VMs vs Containers — Know the Difference

Before we install anything, understand the two types of workloads Proxmox supports. You'll be choosing between them throughout this guide.

Virtual Machines (VMs):

• Full hardware emulation — the VM thinks it has real physical hardware with its own CPU, memory controller, and disk
• Can run any OS: Windows, Linux, BSD, even macOS
• Heavier on resources because the hypervisor has to emulate all that hardware
• Use for: pfSense, Windows Server, Kali, Security Onion — anything that needs a specific OS or full isolation

LXC Containers (CTs):

• Lightweight — share the host's Linux kernel, isolated at the OS level rather than the hardware level
• Linux only — because they share the kernel, they can only run Linux
• Much lower overhead: a container can run with 256MB RAM and start in under a second
• Use for: Pi-hole, simple web servers, monitoring agents, routing nodes
• Think of them as Linux "mini-VMs" that are much cheaper to run

The rule of thumb: use a container when you can, a VM when you must.

Step 1 — Download and Flash Proxmox VE

1. Go to proxmox.com/en/downloads
2. Download the latest Proxmox VE ISO (currently 8.x)
3. Flash it to a USB drive (8GB or larger) using:
   • Rufus on Windows — use DD mode (not ISO mode) when writing the Proxmox ISO. Download at rufus.ie
   • balenaEtcher on any OS — simpler, handles this correctly by default

Step 2 — Install Proxmox VE

1. Insert the USB, reboot your ThinkPad, and enter the boot menu — press F12 at the ThinkPad splash screen (or Enter then F12) to get a one-time boot device selection
2. Select your USB drive
3. The Proxmox installer will load. Follow the prompts:
   • Target disk: your NVMe SSD — this will be completely erased
   • Country/Timezone: set yours
   • Root password: set a strong one — this is your only admin account
   • Hostname: something like proxmox.lab or pve.homelab
   • IP address: give it a static IP on your home network (e.g., 192.168.1.10) — write this down, you'll need it to access the web UI
4. Let it install and reboot — remove the USB when prompted

After the reboot, your ThinkPad will show a minimal console with a message like:

https://192.168.1.10:8006

Open that URL from any browser on your home network. Log in with root and the password you set.

Step 3 — Explore the Proxmox Web UI

The interface has a left-side tree view showing your datacenter and the node (your ThinkPad). Key areas to familiarize yourself with:

Uploading ISOs: Every VM needs an installation ISO. Upload them by going to: Datacenter → your node → local (storage) → ISO Images → Upload. All VMs you create will pull ISOs from here.

Disabling the subscription nag: Proxmox shows a subscription warning on login because it has a paid enterprise tier. For a home lab, paste this in the Proxmox shell to disable it:

sed -i.bak "s/data.status !== 'Active'/false/g" \
  /usr/share/javascript/proxmox-widget-toolkit/proxmoxlib.js
systemctl restart pveproxy

This doesn't affect functionality — it just removes the popup.

Understanding Virtual Network Bridges

A network bridge in Proxmox is like a virtual switch. It connects VMs to each other and to the outside world.

Proxmox creates one bridge by default: vmbr0, which is connected to your ThinkPad's physical network adapter and gives VMs access to your home network and the internet.

You'll create additional bridges to isolate different lab environments:

Why isolation matters: Your Kali Linux and Metasploitable VMs should never be on the same bridge as your home network. If they were, you could accidentally expose vulnerabilities to your real network or trigger alerts on your home router. Always keep attack and target VMs on their own isolated bridge with no physical adapter attached.

An isolated bridge — one with no physical port — is a purely internal virtual switch. VMs on it can talk to each other but cannot reach your home network unless you explicitly route traffic through pfSense.

Snapshots — Your Safety Net

Before moving on, understand snapshots. A snapshot saves the exact state of a VM at a point in time — RAM contents, disk state, everything. You can restore to it in seconds.

Always snapshot before:

• Running attack tools on a target VM
• Making major configuration changes
• Starting a new lab exercise you might want to undo

To take a snapshot: click a VM → Snapshots tab → Take Snapshot.

Name them descriptively: pfsense-vlans-working, kali-before-exploit. Storage is cheap — your time is not.

Part 3 — Network+ Lab

Architecture

The Network+ lab teaches you how real networks are built — routing, subnetting, VLANs, DHCP, DNS, and firewalls. You'll build all of this from scratch using virtual hardware.

Internet / Home Router
        |
        | (vmbr0 - WAN, internet-facing)
   +----+------------------------+
   |        pfSense VM           |
   |    (virtual router and      |
   |      firewall)              |
   +----+------------------------+
        | (vmbr1 - LAN, internal)
        |
        +--- Pi-hole Container   (DNS + DHCP)
        +--- VLAN 10: Workstations
        +--- VLAN 20: Servers
        +--- VLAN 99: Management

pfSense sits between your home network and your lab network — just like a real router sits between the internet and a company's internal network. Everything behind pfSense is your lab, and pfSense controls what can go where.

Step 1 — Create Virtual Network Bridges

Before creating any VMs, set up your bridges. This is like wiring up physical switches before you rack the servers.

1. In Proxmox: Node → Network → Create → Linux Bridge
2. Create vmbr1:
   • Name: vmbr1
   • Comment: Network Lab LAN
   • Leave "Bridge ports" empty — no physical adapter means this is a purely internal switch
3. Click Apply Configuration

Repeat to create vmbr2 (Security Lab — isolated) and vmbr3 (Windows AD lab).

Step 2 — Install pfSense

What is pfSense?

pfSense is a professional-grade open source firewall and router OS based on FreeBSD. It's used in real businesses from small offices to enterprise networks, and it's free. In your lab it acts as your virtual router — controlling traffic between your lab segments, handing out IP addresses via DHCP, and acting as the firewall between your home network and your lab.

Why use pfSense instead of a simpler setup? Because understanding how to configure a real firewall — rules, NAT, DHCP scopes, DNS forwarding — is exactly what Network+ and Security+ test. You're not just checking a box; you're building transferable skills.

Download pfSense: Go to pfsense.org/download — select AMD64 and DVD Image (ISO). Upload the ISO to Proxmox.

Create the pfSense VM:

1. In Proxmox: click Create VM (top right)
2. Settings:
   • Name: pfsense
   • ISO: select the pfSense ISO you uploaded
   • OS Type: Other
   • Disk: 20 GB
   • CPU: 2 cores
   • RAM: 2048 MB (2 GB)
3. Add two network interfaces — this is critical:
   • Network device 1: vmbr0 (WAN — internet-facing)
   • Network device 2: vmbr1 (LAN — your lab network)
   • To add the second after VM creation: Hardware → Add → Network Device

Why two interfaces? A router by definition connects two networks. The WAN interface faces the internet (or your home network), the LAN interface faces your lab. pfSense routes traffic between them and applies firewall rules to control what's allowed through.

Install pfSense:

Start the VM, open its console in Proxmox, and follow the installer. Accept defaults — it will auto-detect WAN (em0 / vmbr0) and LAN (em1 / vmbr1). After the install and reboot, pfSense's web UI called WebConfigurator is available at http://192.168.1.1 from any VM on vmbr1.

Default credentials: admin / pfsense — change these immediately after first login.

Step 3 — Set Up DHCP and DNS

What is DHCP?

Dynamic Host Configuration Protocol automatically assigns IP addresses to devices when they join a network. Without DHCP, you'd manually configure an IP address, subnet mask, default gateway, and DNS server on every single device. DHCP automates all of this — the device joins the network, broadcasts a request, the DHCP server responds with a configuration, and the device is ready to communicate in seconds.

In pfSense, DHCP is already enabled on the LAN by default. To view or configure it: log into WebConfigurator → Services → DHCP Server. You can set the IP range (the "pool" of addresses available to hand out), lease time, and which DNS server to advertise to clients.

What is DNS?

Domain Name System translates human-readable names like google.com into IP addresses like 142.250.80.46. Every time you type a URL or ping a hostname, a DNS lookup happens behind the scenes. Without DNS, you'd need to memorize IP addresses for everything.

For a dedicated DNS server with ad-blocking, use Pi-hole. It's a lightweight DNS server that also filters out known ad and tracking domains — great for a home lab where you want clean network traffic.

Install Pi-hole as an LXC container:

1. In Proxmox shell, download an Ubuntu container template:

pveam update
pveam available | grep ubuntu
pveam download local ubuntu-22.04-standard_22.04-1_amd64.tar.zst

2. Create the container: Create CT

   • RAM: 512 MB
   • CPU: 1 core
   • Disk: 4 GB
   • Network: attach to vmbr1
   • Give it a static IP (e.g., 192.168.1.2)

3. Start the container and open its console, then install Pi-hole:

curl -sSL https://install.pi-hole.net | bash

Follow the prompts. When asked which DNS upstream to use, choose Cloudflare (1.1.1.1) or Google (8.8.8.8) — Pi-hole will forward queries it doesn't block to this server.

4. In pfSense WebConfigurator: Services → DHCP Server → set the DNS server field to your Pi-hole container's IP. Now every device that gets an address from pfSense will automatically use Pi-hole for DNS.

Why does this matter for Network+? Understanding the relationship between DHCP, DNS, and routing is fundamental — these three services are the backbone of how any network functions. You'll be configuring and troubleshooting them in real jobs from day one.

Step 4 — Configure VLANs

What is a VLAN?

A VLAN (Virtual LAN) lets you logically segment one physical network into multiple isolated networks without running separate cables. Imagine your office has one network infrastructure, but IT wants the finance department isolated from the engineering department for security reasons — VLANs do this in software.

VLANs are identified by a tag (a number from 1 to 4094). Traffic tagged with VLAN 10 can only communicate with other VLAN 10 devices unless you explicitly create firewall rules allowing traffic between VLANs. This is called inter-VLAN routing, and it always goes through a router or Layer 3 switch — in your case, pfSense.

Why practice VLANs? They appear in nearly every enterprise network and are a key Network+ exam topic. More importantly, understanding VLANs is the difference between someone who just "knows networking" and someone who can actually design and troubleshoot real network segmentation.

Set up VLANs in pfSense:

1. Log into pfSense → Interfaces → Assignments → VLANs → + Add
2. Create VLAN 10:
   • Parent interface: em1 (your LAN)
   • VLAN tag: 10
   • Description: Workstations
3. Repeat for VLAN 20 (Servers) and VLAN 99 (Management)
4. Assign each VLAN as a pfSense interface: Interfaces → Assignments → + Add, select each VLAN
5. Enable each interface and assign an IP (e.g., VLAN 10 = 10.10.10.1/24, VLAN 20 = 10.10.20.1/24, VLAN 99 = 10.10.99.1/24)
6. Enable DHCP on each VLAN: Services → DHCP Server, select each interface and set an IP pool

Test with a VM:

1. Create a small Linux VM (Ubuntu minimal or Alpine Linux — Alpine uses only 128MB RAM)
2. Attach it to vmbr1
3. In the VM's network configuration, set the VLAN tag to 10
4. Boot the VM — it should receive an IP in the 10.10.10.x range via DHCP
5. Ping the pfSense gateway (10.10.10.1) — it should respond
6. Try pinging a VLAN 20 address — by default it should fail (they're isolated)
7. Create a pfSense firewall rule to allow VLAN 10 to reach VLAN 20 and test again

This exercise teaches you exactly how enterprise network segmentation works — and how firewall rules control traffic between segments.

Step 5 — Practice Routing with OSPF

What is OSPF?

Open Shortest Path First is a routing protocol — it's how routers automatically discover network paths and share that knowledge with each other. In a network with multiple routers, OSPF lets them announce which networks they can reach, calculate the best path to each destination, and automatically re-route around failures.

Without dynamic routing protocols like OSPF, you'd need to manually configure a static route on every router for every destination network. In a network with hundreds of routers and thousands of subnets, that becomes unmanageable. OSPF solves this by having routers exchange routing information and build their own routing tables dynamically.

Simple lab exercise:

1. Create two lightweight Ubuntu LXC containers on separate bridges (one on vmbr1, one on vmbr2)
2. Install FRR (Free Range Routing) on each — FRR is a Linux routing suite that implements real routing protocols including OSPF, BGP, and others:

apt install frr -y

3. Edit /etc/frr/daemons on each container and set ospfd=yes
4. Configure OSPF on each container's FRR and watch them exchange routes
5. Observe the routing table build itself:

ip route show

You should see routes to the other container's network appear automatically — OSPF learned them.

Network+ Lab Exercises Checklist

Work through these in order — each builds on the previous one:

• Install Proxmox and access the web UI
• Create virtual bridges vmbr0, vmbr1, vmbr2, vmbr3
• Install and configure pfSense with WAN and LAN interfaces
• Verify DHCP is handing out IPs to VMs on vmbr1
• Set up Pi-hole as a DNS container
• Configure pfSense to advertise Pi-hole as the DNS server
• Create VLANs 10, 20, and 99 in pfSense
• Verify a test VM gets an IP on the correct VLAN
• Configure inter-VLAN routing via pfSense firewall rules
• Block traffic between VLANs and verify the block works
• Set up a static route and verify with traceroute
• Capture traffic with Wireshark inside a VM
• Configure OSPF between two Linux containers
• Use nmap to discover hosts on a subnet

Part 6 — Study Tips and Resources

Lab Best Practices

Snapshot religiously. Before any major change or experiment, take a Proxmox snapshot. Name them descriptively: pfsense-vlans-working, kali-before-metasploit. Storage is cheap; your time is not.

Document everything. When you configure something, write down what you did and why. Six months from now you'll need to rebuild something or troubleshoot an issue — your notes are your documentation. The best lab documentation is the one you actually update.

Break things intentionally. Misconfigure a firewall rule. Delete a DNS record. These "failures" teach you more than clean installs. Proxmox snapshots make this risk-free — you can always revert.

Use your lab for the exam, not instead of it. The lab gives you hands-on intuition that makes study material click. But CompTIA exams also have specific wording and concepts that require reading official materials. Use both together.

Label your VMs clearly. Use descriptions in Proxmox. It helps when you have 12 VMs and can't remember which is which. Proxmox also supports color-coded tags — useful for grouping by lab type.

Free Resources

Key Commands Reference

Proxmox (run in host shell):

qm list                          # list all VMs and their status
qm start [vmid]                  # start a VM by ID
qm stop [vmid]                   # stop a VM
pct list                         # list all LXC containers
qm snapshot [vmid] [name]        # take a named snapshot

Network troubleshooting (Linux):

ip addr show                     # show all interfaces and IP addresses
ip route show                    # show the routing table
ping [ip]                        # test basic connectivity
traceroute [ip]                  # trace the path to a destination
nmap -sn [network/cidr]          # discover hosts on a subnet
ss -tulnp                        # show all listening ports and services
dig [domain]                     # DNS lookup — see what resolves to what
tcpdump -i eth0                  # capture packets on an interface

What's Next

Part 2 — Security+ Lab covers everything you need to build a working security operations environment: Security Onion for threat detection, Kali Linux as your attack platform, Metasploitable as a safe vulnerable target, a Windows Active Directory environment, and OpenVAS for vulnerability scanning. You'll run real attack scenarios and watch your detection tools catch them.

Proxmox VE 8.x · pfSense CE / OPNsense · Pi-hole · FRR ThinkPad P14s Gen 2 AMD — Ryzen 5850U · 48GB RAM