Cybersecurity Home Lab 2026: Complete Setup Guide for Ethical Hackers

A cybersecurity home lab is a controlled, isolated environment where you legally practice offensive and defensive security techniques. It is the single most effective way to build practical skills for roles like penetration tester, SOC analyst, or security engineer. This guide covers hardware selection, hypervisor setup, VM topology, tool stack, and a structured learning path — from first boot to advanced exploitation.

---

What Is a Cybersecurity Home Lab?

A cybersecurity home lab is a private network of virtual machines (VMs) running on hardware you control. It includes:

• At least one attacker machine (typically Kali Linux)
• One or more vulnerable target machines (Metasploitable, DVWA, HackTheBox VMs)
• A firewall/router VM (pfSense or OPNsense) for network segmentation
• Optionally, a logging/SIEM server (Security Onion, Elastic Stack)

The key principle: all traffic stays inside your lab. Your home devices and the public internet are never exposed to attack traffic.

---

Hardware Options: Budget, Mid-Range, and Professional

You do not need expensive hardware to start. The minimum viable lab runs on a single machine with virtualization.

| Tier | Hardware | RAM | Storage | Estimated Cost | |------|----------|-----|---------|---------------| | Budget | Old desktop or laptop (5–8 years old) | 16 GB | 256 GB SSD | $0–$100 (reused) | | Budget+ | Raspberry Pi 4 (support role only) | 8 GB | 64 GB microSD | $80–$120 | | Mid | Intel NUC 12 or Beelink Mini PC | 32 GB | 500 GB NVMe | $350–$550 | | Professional | Refurbished Dell/HP workstation | 64 GB | 1 TB NVMe + HDD | $600–$1,200 | | Advanced | Used rack server (R720, DL380) | 128 GB+ | 2 TB RAID | $800–$3,000 |

Recommendation for 2026 beginners: A Beelink SER5 or similar mini PC at around $300–$400 with 32 GB RAM gives you everything you need to run 6–8 VMs simultaneously without noise or high electricity costs.

Minimum CPU Requirements

Your CPU must support hardware virtualization:

• Intel: VT-x enabled in BIOS
• AMD: AMD-V enabled in BIOS

Check with egrep -c '(vmx|svm)' /proc/cpuinfo — any result above 0 means you're good.

---

Hypervisor Selection: Proxmox vs ESXi vs VirtualBox

A hypervisor is the software layer that runs multiple operating systems on one physical machine.

| Hypervisor | Type | Cost | Use Case | |------------|------|------|----------| | Proxmox VE 8 | Type 1 (bare metal) | Free | Recommended for dedicated lab machines | | VMware ESXi 8 | Type 1 (bare metal) | Free (limited) | Enterprise-like experience, fewer free features | | VirtualBox 7 | Type 2 (hosted) | Free | Runs on top of your main OS, easiest start | | VMware Workstation Pro 17 | Type 2 (hosted) | Free as of 2024 | Best Type 2 option, now free for personal use | | QEMU/KVM | Type 1 | Free | Linux-native, maximum control, steeper learning curve |

Best choice for a dedicated home lab machine: Proxmox VE 8. It is free, open source, supports clustering, and has a mature web interface. It runs KVM VMs and LXC containers side by side.

Installing Proxmox VE 8

1. Download the ISO from proxmox.com
2. Flash to USB with Ventoy or Rufus
3. Boot and install to your target machine (erases the disk)
4. Access the web UI at https://[your-ip]:8006
5. Remove the enterprise repository and add the free community repo

---

VM Lab Topology

A well-designed lab separates traffic into distinct network segments. Here is a standard topology for a cybersecurity home lab:

[Internet] — [Router/Modem]
                  |
           [pfSense VM]
          /      |       \
   [WAN]   [LAN mgmt]  [Attack VLAN]  [Victim VLAN]
                              |               |
                         [Kali Linux]   [Metasploitable]
                                        [DVWA]
                                        [Windows Server]

Network Segments to Create

• Management network (192.168.1.0/24): Proxmox host access and admin interfaces
• Attack network (10.10.10.0/24): Your Kali Linux attacker VM
• Victim network (10.10.20.0/24): All vulnerable targets
• DMZ (10.10.30.0/24): Optional — simulates exposed web servers

pfSense enforces firewall rules between all segments. By default, deny all traffic from victim network to management. Allow attacker to victim only.

---

Core VM Stack

The Attacker Machine: Kali Linux 2025.x

Kali Linux is the industry-standard penetration testing distribution, maintained by Offensive Security. It ships with 600+ pre-installed tools including:

• Nmap, Masscan (reconnaissance)
• Metasploit Framework 6 (exploitation)
• Burp Suite Community (web testing)
• Wireshark (packet analysis)
• Hashcat, John the Ripper (password cracking)

Minimum specs for Kali VM: 2 vCPUs, 4 GB RAM, 40 GB disk.

The Primary Target: Metasploitable 2/3

Metasploitable is a purposely insecure Ubuntu VM from Rapid7. Version 2 is simpler and more widely documented. Version 3 adds Windows and more complex services.

Pre-installed vulnerable services include: FTP (vsftpd 2.3.4 backdoor), SSH (default credentials), Samba (multiple CVEs), MySQL (no password), UnrealIRCd (backdoor), Tomcat (default credentials).

Minimum specs: 1 vCPU, 512 MB RAM, 8 GB disk.

Web Application Practice: DVWA

DVWA (Damn Vulnerable Web Application) is a PHP/MySQL web app with adjustable difficulty levels for:

• SQL Injection
• Cross-Site Scripting (XSS)
• Cross-Site Request Forgery (CSRF)
• File Inclusion
• Command Injection
• Brute Force

Deploy it as a Docker container or on a dedicated VM running LAMP stack.

Full Tools Reference Table

| Tool | Category | License | Key Use | |------|----------|---------|---------| | Nmap 7.x | Recon | Free | Port scanning, service detection | | Metasploit Framework 6 | Exploitation | Free (community) | Exploit development and delivery | | Burp Suite Community | Web testing | Free | Intercepting proxy, scanner | | Wireshark | Packet analysis | Free | Traffic capture and dissection | | Hashcat | Password cracking | Free | GPU-accelerated hash cracking | | BloodHound | AD enumeration | Free | Active Directory attack path mapping | | CrackMapExec | Network | Free | SMB enumeration and exploitation | | Impacket | Protocol tools | Free | Python libs for Windows protocols | | OWASP ZAP | Web testing | Free | Automated web vulnerability scanner | | Security Onion | SIEM/IDS | Free | Threat detection and log analysis |

---

Network Segmentation: Step-by-Step with pfSense

pfSense is a free, open-source firewall and router built on FreeBSD. It runs as a VM inside Proxmox.

pfSense VM Setup

1. Download pfSense CE 2.7.x ISO
2. Create a VM: 1 vCPU, 1 GB RAM, 8 GB disk
3. Assign three network interfaces: WAN (bridges to your physical NIC), LAN management, and OPT1 for the lab VLAN
4. Follow the installer — defaults are fine
5. Access the web configurator at https://192.168.1.1

Essential Firewall Rules

• Block all traffic from victim VLAN to management VLAN
• Allow TCP from attack VLAN to victim VLAN (all ports, for pentesting)
• Block attack VLAN from reaching WAN (prevents accidental external scanning)
• Allow management VLAN to reach all zones (for admin access)

---

Structured Learning Path

Phase 1: Foundations (Weeks 1–4)

• Set up Proxmox and pfSense
• Deploy Kali and Metasploitable 2
• Learn Nmap: host discovery, port scanning, service detection, OS fingerprinting
• Complete the Nmap scripting engine (NSE) basics

Phase 2: Exploitation Basics (Weeks 5–8)

• Metasploit Framework: msfconsole, search, use, set, exploit
• Exploit the vsftpd 2.3.4 backdoor on Metasploitable
• Exploit Samba MS-RPC vulnerabilities
• Introduction to reverse shells and bind shells

Phase 3: Web Application Testing (Weeks 9–12)

• Deploy DVWA and OWASP Juice Shop
• Practice SQL injection: manual and with sqlmap
• XSS: reflected, stored, DOM-based
• Burp Suite: intercept, modify, repeat, scan

Phase 4: Active Directory (Weeks 13–20)

• Build a Windows domain: Windows Server 2022 (evaluation license) + 2 Windows 10 VMs
• Install BloodHound and collect AD data
• Practice Kerberoasting, Pass-the-Hash, DCSync
• Mimikatz and credential dumping

Phase 5: Defensive Skills (Weeks 21–28)

• Deploy Security Onion on your victim network
• Generate malicious traffic and detect it in the SIEM
• Write Sigma rules for custom detections
• Practice incident response on a compromised VM

---

Legal Considerations

You must only attack systems you own or have explicit written permission to test. This rule is absolute. Key legal frameworks to know:

• United States: Computer Fraud and Abuse Act (CFAA) — unauthorized access to computer systems is a federal crime
• European Union: Directive on attacks against information systems (2013/40/EU)
• United Kingdom: Computer Misuse Act 1990

Never use your lab techniques outside the lab without a signed scope-of-work agreement. Bug bounty programs (HackerOne, Bugcrowd) provide legal authorization to test specific production systems — read their terms carefully.

Safe practice alternatives: TryHackMe, Hack The Box, PentesterLab, and VulnHub all provide legal, pre-authorized targets in the cloud or as downloadable VMs.

---

Cost Summary

| Component | Budget Option | Mid-Range | Cost | |-----------|--------------|-----------|------| | Hardware | Old PC | Beelink mini PC | $0–$400 | | Hypervisor | Proxmox VE | Proxmox VE | Free | | pfSense | pfSense CE | pfSense CE | Free | | Kali Linux | Kali 2025 | Kali 2025 | Free | | Metasploitable | MS2 | MS2 + MS3 | Free | | Windows evaluation | 180-day eval | 180-day eval | Free | | Online labs (optional) | TryHackMe | Hack The Box | $14–$20/month |

Total hardware investment: $0–$600 depending on what you already own.

---

Take It Further

Building the lab is step one. The MAG Editions Cybersecurity Home Lab guide provides a structured 28-week curriculum mapped to real certifications (eJPT, OSCP prep), with pre-built Proxmox templates, pfSense config exports, and a curated exercise library for each phase. It cuts setup time from days to hours and gives you a repeatable progression from beginner to job-ready.

---

Key Takeaways

• A cybersecurity home lab requires one physical machine with 16–32 GB RAM and a modern CPU
• Proxmox VE + pfSense + Kali + Metasploitable is the standard free stack
• Network segmentation prevents your lab from contaminating your home network
• Legal practice is non-negotiable — only attack systems you own or have permission to test
• A structured learning path from recon through Active Directory takes 20–28 weeks of consistent practice