Proxmox Homelab Cluster
ActiveOverview
Dual-ISP home network managed by a Firewalla Gold router with two Proxmox nodes (pve1 and pve2). Seven VLANs segment traffic by trust level, with an inline Security Onion tap on pve1 monitoring all traffic between the router and switch.
Hardware
Firewalla Gold handles routing, firewall, DHCP, DNS, and VLAN gateways. The Firewalla Switch SE manages VLAN trunking across ports. The Firewalla AP7 provides multi-SSID wireless with WPA3-Enterprise on the primary home SSID. pve1 is a dual-NIC desktop running Proxmox and hosting the Security Onion inline tap. pve2 is a second Proxmox node hosting the AD lab VMs.
VLAN Design
Eight VLANs segment traffic by trust level and function. Firewalla uses a block-all-then-allow-exceptions policy per VLAN. VLAN 10 (Home) can reach Lab and SecOnion for management. VLAN 30 (Lab) and VLAN 33 (SecOnion) are bidirectionally open to each other. VLAN 40 (Work) is fully isolated on CenturyLink as its primary WAN. VLAN 60 (Threat Lab) is reserved for future threat hunting — uses 10.66.0.0/16 intentionally to make its traffic instantly identifiable in logs.
WAN Routing
Mediacom (1Gbps) is primary for all VLANs except Work. CenturyLink (100Mbps) is primary for VLAN 40 (Work) and failover for everything else. VLAN 60 (Threat Lab) has no internet access by default — narrow temporary allow rules are created per test and deleted after.
Proxmox Bridges
vmbr0 is the default bridge on native VLAN for Security Onion monitoring traffic. vmbr1 carries VLAN 30 for lab VMs including the AD domain controller at 192.168.30.10. vmbr2 is reserved for VLAN 60 threat lab VMs. Both nodes share /etc/pve/ config via the cluster filesystem.