A working network lab, built and tested end to end.
I built a VirtualBox lab to practice routing, DHCP, DNS, Active Directory, and Windows deployment. I use it to trace failures across the network, verify fixes, and document the results.
Russell Everson · IT specialist and network administrator
Lab path · 192.168.50.0/24
Internet / NATVirtualBox uplink
OPNsenseGateway · 192.168.50.1
DC01AD · DNS · WDS 192.168.50.10
PXE-Test / Lab1Windows clients
UbuntuDHCP test client
Lab evolution / Current capabilities and future architecture
From a working home lab to an enterprise-style environment
This roadmap distinguishes what I have built and tested from planned projects. The future topology is a design goal—not a claim that the equipment, network segmentation, or security services are already deployed.
Lab evolution: current infrastructure, planned milestones, and future enterprise-style architecture. Future components are design goals.
Current lab · Built and tested
Working infrastructure
✓
OPNsense firewallLAN 192.168.50.1; WAN recently observed at 192.168.1.128. Web management, external ping, and DNS tested.
✓
DC01 · Windows Server 2022192.168.50.10 · lab.local · AD DS, DNS, WDS; LDAP (389) and Kerberos TCP (88) reachability tested.
✓
Windows 11 clientsPhysical Windows 11 Pro laptop joined to lab.local; desktop management address 192.168.50.20.
PXE and imaging groundworkWDS/WinPE installed; virtual PXE boot and Windows image-application exercises performed. Repeatable physical PXE deployment is the next goal.
✓
Guest interfaceOPNsense guest subnet 192.168.60.0/24 and captive-portal testing; Wi-Fi access point and full VLAN integration are future work.
Future vision · Planned and proposed
Enterprise-style capabilities
→
Automated network imagingPXE boot physical laptops from DC01, test drivers and Windows edition selection, and document repeatable deployment procedures.
→
Cisco router and Catalyst switchEvaluate refurbished gear, verify IOS features and licensing, then practice trunks, routing, OSPF, and failure recovery.
→
VLAN segmentation and access controlsSeparate management, clients, servers, security cameras, guests, and IoT. Future VLAN subnet assignments will be designed and tested rather than assumed.
→
Cameras, phones, and tabletsIsolated camera/NVR network, mobile notifications, guest and trusted device Wi-Fi, and secure access to permitted services.
→
Raspberry Pi and cybersecurity labMonitoring experiments plus an isolated, authorized Kali Linux / WiFi Pineapple / ESP32 testing environment.
→
VPN and central dashboardSecure remote lab access, device availability, service health, logging, alerts, and configuration documentation.
Build sequence
01 / NEXTPXE deployment
Reliable installation from the WDS server to physical computers.
02 / DESIGNVLANs and Cisco
Validate switching, routing, trunks, and isolation.
03 / EXPANDDevices and security
Add cameras, mobile devices, IoT, and isolated testing equipment.
04 / OPERATEMonitoring and VPN
Secure remote access and operational dashboards.
Current IP addresses reflect recent lab tests; future VLAN IP ranges and device addresses have not yet been assigned. This section is updated as milestones are completed.
01 / Architecture
Services that work together
The virtual LAN is isolated in VirtualBox. OPNsense connects that LAN to a NAT uplink, while DC01 provides identity, name resolution, and deployment services.
Routing & addressing
OPNsense + Kea DHCP
Configured the LAN gateway at 192.168.50.1/24 and issued client addresses on the lab subnet. Pointed client DNS toward DC01.
Identity & DNS
Windows Server 2022
Promoted DC01 for lab.local at 192.168.50.10. Tested domain membership, DNS resolution, user accounts, groups, and shared-folder access.
Cross-platform testing
Windows + Ubuntu
Used Windows clients and Ubuntu Server to verify DHCP leases, gateway reachability, DNS, and internet access from the virtual LAN.
Physical switching / November 2026
Managed switching and 802.1Q VLAN segmentation
Expanded the virtual network lab with a NETGEAR GS108E eight-port managed switch. Established management connectivity, created purpose-specific VLANs, and configured access ports and a trunk-mode uplink for future integration.
Verified · Management
Restored switch access
Diagnosed APIPA addressing on a dedicated desktop Ethernet interface, assigned 192.168.0.10/24, and successfully reached the switch at 192.168.0.239 without modifying the existing home Wi-Fi network.
Configured · VLANs
Purpose-specific segmentation
Created VLAN 10 (MGMT), 20 (Clients), 30 (Security), 40 (servers), and 50 (Guest) using Basic 802.1Q mode. Retained VLAN 1 for the current management connection.
Configured · Ports
Access ports and uplink
Assigned port 2 to VLAN 10; ports 3–4 to VLAN 20; ports 5–6 to VLAN 30; port 7 to VLAN 40; and port 8 to trunk mode. Port 1 remains an access port on VLAN 1.
Validation still pending: Test connectivity and isolation with physical clients, verify trunk VLAN allowances and tagging, and attach a lab access point for the Guest VLAN. These results are not yet claimed as completed.
Current projects / November 2026
Hardware recovery and automation practice
HP Stream · Imaging
Investigating boot failure and restoring deployment
Investigated HP boot error 3F0; storage passed the HP quick diagnostic, and Windows Setup detected the approximately 58 GB internal drive. Confirmed there were no partitions, rebuilt installation media using Rufus, and successfully booted the laptop to Windows 11 Setup. The device subsequently reached Windows first-run naming, with final installation and driver validation pending.
Python · Early development
Cisco Price Hunter
Started cisco_price_hunter.py to practice input validation, variables, price comparisons, and formatted output. Fixed a Python NameError during local testing. Live marketplace integration and automated comparison remain planned features.
Security automation · In progress
Portfolio visit notifications
The portfolio contains a browser-side POST request to a Cloudflare Worker intended to trigger a Pushover alert for website visits. End-to-end notification delivery has not yet been verified; rate limiting and reliability checks remain to be completed.
02 / Deployment project
PXE boot to physical imaging
The deployment exercise began with WDS on DC01 and progressed from a virtual PXE client to a bootable WinPE USB for an isolated physical laptop.
Network boot
WDS and Windows PE
Installed WDS integrated with Active Directory, added an x64 Windows PE boot image from the ADK, and booted PXE-Test through UEFI into the WinPE command prompt. Confirmed a DHCP lease and successful ping to DC01.
Virtual deployment
Windows 11 image
Applied Windows 11 Pro from an install.wim share to a GPT disk, built UEFI boot files, configured Recovery, and reached Windows setup in PXE-Test.
Portable media
Two-partition USB
Created a 2 GB FAT32 WinPE boot partition and an NTFS image partition for the image file larger than FAT32's 4 GB file limit. Booted a physical laptop from the USB into WinPE.
Physical deployment
Image applied to the laptop
Identified the internal Kingston drive separately from the ONN USB, prepared EFI, Microsoft Reserved, Windows, and Recovery partitions, applied the Windows 11 Pro image, created UEFI boot files, and registered Windows Recovery. First boot verification is the remaining check.
Deployment details
Deployment server
DC01 · Windows Server 2022
Boot environment
Windows PE (AMD64) · UEFI
Image source
Windows 11 install.wim, Pro index 6
Validation completed
PXE-Test network
192.168.50.101 · DC01 ping replies
Virtual deployment
Windows 11 setup reached
Physical deployment
DISM, BCDBoot, and ReAgentc succeeded
03 / Troubleshooting notes
Problems traced to their cause
Ubuntu received IPv6 but no IPv4 lease
Checked its VirtualBox network attachment and moved the client onto the same internal network as the OPNsense LAN. It later received 192.168.50.106.
PXE-Test showed a black screen with UEFI
Changed the virtual machine to one vCPU. It subsequently displayed Windows Boot Manager, loaded WinPE, and reached the command prompt.
WinPE could not use the physical USB as one FAT32 volume
Separated boot files and the larger Windows image into FAT32 and NTFS partitions, then verified the image was visible from WinPE on the laptop.
Routing project / October 12, 2026
OSPF routing and a tested backup path
Built a Cisco Packet Tracer network with three 2911 routers, two 2960 switches, and two PCs. Configured separate LAN and transit subnets, established OSPF neighbors in area 0, and verified that the PCs could still communicate after the direct router link was disabled.
Static routing
Established paths in both directions
Assigned interface addresses and PC default gateways, enabled router ports, and tested each local link. Diagnosed destination-host-unreachable messages by inspecting routing tables. Added static routes for the opposite LAN and its return path, then verified PC-to-PC ping.
Dynamic routing
Replaced static routes with OSPF
Enabled OSPF process 1 in area 0 using network statements and wildcard masks. Verified FULL neighbor states, removed the static routes, and confirmed remote LAN entries marked O in the routing tables.
Resilience test
Verified the alternate route
Added a middle router and two new transit networks. Corrected missing interface addresses and enabled the outer routers' new ports. After both new OSPF neighbors formed, shut down R1's direct link to R2: the PC-to-PC ping still received replies through the middle router.
Addressing plan
Left LAN / gateway
192.168.10.0/24 / 192.168.10.1
Right LAN / gateway
192.168.11.0/24 / 192.168.11.1
Direct R1–R2 link
192.168.12.1 ↔ 192.168.12.2
R1–middle link
192.168.13.1 ↔ 192.168.13.2
Middle–R2 link
192.168.14.1 ↔ 192.168.14.2
Verification commands
Interface addresses and status
show ip interface brief
OSPF interface participation
show ip ospf interface brief
Neighbor synchronization
show ip ospf neighbor
Learned routes
show ip route
End-to-end reachability
PC ping to 192.168.11.2
Observed result: PC-to-PC ping succeeded with the direct link disabled. This demonstrates OSPF reconvergence to the alternate path in the simulation; convergence time and packet loss during the transition were not measured.
Packet analysis / Learning in progress
Wireshark: connect symptoms to packet evidence
I am learning Wireshark on my desktop through video study and practice. My current focus is selecting the right capture adapter, filtering traffic, and explaining what DNS, ARP, and ICMP packets reveal about connectivity.
Name resolution
Follow a DNS exchange
Practice finding a query and its matching response with the dns display filter. Compare a successful lookup with repeated queries that have no visible answer.
Local delivery
Understand ARP and the gateway
Use arp to examine local address resolution. For an off-subnet destination, identify why the client needs the gateway’s MAC address.
Connectivity
Compare ping requests and replies
Use icmp to match echo requests and replies. Separate direct-IP reachability from name resolution, and avoid drawing conclusions beyond the evidence.
Interactive teaching example: Filter a synthetic packet trace, inspect individual packets, and compare successful DNS with an unanswered query. This demonstration is simulated and does not represent a completed capture from my lab.
Formal academic study in network management, wireless and information security, and military information systems technology complements the hands-on infrastructure and troubleshooting projects documented here.
Graduate degree
Master of Network and Communications Management
Keller Graduate School of Management, DeVry University · June 25, 2011
Graduate studies included wireless networking and IT security.
Undergraduate degree
Bachelor of Science
University of Maryland University College (UMUC) · December 2007
Major pending transcript verification.
Military education
Associate in Applied Science — Information Systems Technology
Community College of the Air Force (CCAF) · April 23, 2007
Associate degree
Human Resources
Western Wisconsin Technical College (WWTC)
Master's, bachelor's, and CCAF associate degree titles and dates were checked against diploma photographs. Wireless and IT security were part of the master's studies, not listed as a separate certificate. The bachelor's major and Human Resources associate degree title remain pending documentary verification. Diploma images and personal identifiers are not published.
04 / Build log
What I am validating next
Complete Windows first-run setup and verify the HP Stream drivers; then test VLAN isolation on the physical NETGEAR switch, validate the trunk uplink, and complete the portfolio notification service. Planned additions also include print services and a dedicated guest wireless network.
Lab scope: The deployment image is Windows 11 Pro. The physical laptop is being used as a temporary imaging exercise; activation requires an appropriate Pro license. Production deployment would also include hardware checks, drivers, backups, and licensing verification.
