Home Lab Introduction

Intro

When I was learning cybersecurity topics in the past year, I’ve grasped lots of different tools and techniques.

Some of the most iconic for me were:

1. CAN BUS (controller area network)

2. Radio Frequency

3. Cryptography

I was lucky to have an opportunity to learn from OTW books. I really like his learning style.

Anyway, when I was studying, one thing seriously caught my attention and I knew that I will try to build it - Honeypot.

I was surprised that this method is actually in use to defend against “bad guys”.

Homelab begins

I wanted to build honeypot, for that i needed HW (aka Homelab). That’s when I decide to analyze what kind of HW I need.

I’ve already had Raspberry Pi 3B, it’s a decent micro computer for some tasks. I needed some networking hardware.

I bought MikroTik router and TP-Link 8 ports switch. I also had to buy few ethernet cables.

Having your own router is a good option to legally break network. You can test your Wi-Fi breaking skills and experiment with different configurations.

Gear used

TP-Link TL-SG108E Gigabit Switch

Mikrotik hAP ac2

Raspberry Pi 3b

Honey Pot

It took me some time to finally try to build a honeypot. Life happens as the old saying says.

So yeah, I began to dive deeper, to plan, to make a schema on how it should look like. I was thinking on how can I scale it in the future.

First lesson

When I’ve connected the Ethernet wires and I’ve tried to connect to the Switch admin panel I’ve got some difficulties. After about 30 minutes I’ve found out that I cannot connect to the Switch, because my ISP router blocks the connection and the craziest thing is that ISP router is also a TP-Link, so the admin login page looks the same.

It is only one lesson which I had. There were many others.

Here’s the schema of my current home lab:

Current phase

Now I have software set up on my Raspberry. I also have VLAN configured in the Switch for the honeypot.

Problems that I’m solving now:

1. Making Mikrotik to act as a separate router, not to be on the same subnet as my ISP router. I already found the way to do it. Using mactelnet I can connect to the Mikrotik using it’s MAC address. Then I have full admin privilege for the router.

2. Before turning the honeypot on, I want to make sure to keep my anonymity, because let’s be real. I will open the doors for all hackers around the world. I’m thinking that maybe I could rent a place somewhere to keep the home lab running.

Vision for later

1. After the successful launch, I’m planning to set up a log management system. Possible options are:

   1. ELK / OpenSearch

   2. Graylog / Loki + Grafana

2. For alerts and SIEM I’m thinking to try Wazuh.

Now I’m diving deep into the TCP/IP. I have physical Charles M. Kozierok TCP/IP guide. That knowledge will let me understand on how the process works from the smallest technical details and why things break.

Outro

I learn new thing every experiment session that I have.

I remember one guy who told me - “why do you need physical lab? Just use virtual machines”. The answer is - physical lab gives you the real feel on how the set up happens. For example that case where the ISP router blocked the access to the Mikrotik router was really surprising. If you’d use virtual machines, you wouldn’t get these surprising scenarios.

So yeah, It is kind of an intro blog post about my home lab. For sure there will be other updates about the process.

Cheers and have a wonderful Christmas and a happy new year!