[{"content":"","date":"20 July 2026","externalUrl":null,"permalink":"/categories/","section":"Categories","summary":"","title":"Categories","type":"categories"},{"content":" Placing components around the House # Specifying tasks for each component of my homelab is just half the hustle. The other main problem is understanding how I could place them in my house.\nBypassing room locations # Just to give a bit of context (without doxxing myself too much): my house does not have cabled Ethernet, meaning that I have no way of connecting my hosts to my router if I were to put them in another room. However, there is no way I could manage placing all components in the same place without having my family kill me (my router is placed in my living room and barely fits there). So, how can I get around this problem?\nThe best solution would be to buy some mesh Wi-Fi devices, which effectively \u0026ldquo;replicate\u0026rdquo; my router\u0026rsquo;s Wi-Fi in the different places where they are put. This way, if I were to put my Lenovo laptop in a different room from the modem, I could attach a mesh device, connect it to my house\u0026rsquo;s Wi-Fi and link it to my laptop via Ethernet. This is the best solution because it requires minimal latency compromises and effectively adds another AP for the same Wi-Fi in another location.\nAn example of a mesh network However, mesh devices can cost a bit, and I have to admit that I didn\u0026rsquo;t consider this solution originally, which is why I had to fall back on a second, less-reliable option. In my case, the architecture is similar to that with mesh devices, but instead of using them I would put a Wi-Fi repeater to replicate my router\u0026rsquo;s signal in another room, and then link it to my laptop, again, with an Ethernet cable. This is a suboptimal solution, of course, since the replicated Wi-Fi is different from the original one, and there is no way to create VLANs to segment the network via wireless, but it will do for now.\nRouting # The use of a repeater/mesh device only solves the problem at the physical level. However, we still have to solve the part about routing rules.\nSwitch # For homelabs, it is typically suggested to segment the network into logically separate units: this means that if a homelab device is compromised, an attacker cannot reach user devices on the original home network (which is the one actually providing connectivity). This separation is usually achieved using VLANs, which are logical network units that separate a network into smaller parts. VLANs are usually implemented by adding a small \u0026ldquo;tag\u0026rdquo; to a packet, which is then read by either a router or a switch and routed to the correct VLAN.\nHow VLANs work with different switches and a router. In my case, I have just one router and one switch In my current setup, it is impossible to implement network segmentation at the wireless level using VLANs, because repeaters generally (and mine specifically) are not built to support them. This means that I have to assume that the connection coming from the repeater is virtually a continuation of my home network, which means that there is no segmentation. If I were to connect the repeater to the Wi-Fi, I would thus be able to link only one device via Ethernet, and the network would look something like this:\nflowchart LR router[Home router] --\u003e|Wi-Fi| repeater[Wi-Fi repeater] repeater --\u003e|Ethernet| lenovo[Lenovo PC] In order to \u0026ldquo;multiplex\u0026rdquo; the Ethernet connection to allow linking multiple hosts, I had to add a small TP-Link switch with 8 ports, a Gbit connection, and VLAN support. Adding the Ethernet connection makes the network evolve into this logical representation:\nflowchart LR router[Home router] --\u003e|Wi-Fi| repeater[Wi-Fi repeater] repeater --\u003e|Ethernet| switch[TP-Link switch] switch --\u003e|Ethernet| lenovo[Lenovo PC] switch --\u003e|Ethernet| pi5[Raspberry Pi 5] switch --\u003e|Ethernet| pi4[Raspberry Pi 4] VLANs # Right now, however, the network is still not segmented: I have just extended the repeater to connect multiple devices. I could start segmentation by adding VLANs behind the switch: I decided to allocate VLAN ID 10 for the Lenovo PC and the Pi 5 (since we said that they have to be able to communicate). The Pi 4 (which will be connected, in the future, to all IoT devices in the house) will get a separate network with ID 20:\nflowchart TD router[Home router] --\u003e|Wi-Fi| repeater[Wi-Fi repeater] repeater --\u003e|Untagged Ethernet| switch[TP-Link switch] subgraph vlan10[VLAN 10: Homelab] lenovo[Lenovo PC] pi5[Raspberry Pi 5] end subgraph vlan20[VLAN 20: IoT] pi4[Raspberry Pi 4] end switch --\u003e|Access port: VLAN 10| lenovo switch --\u003e|Access port: VLAN 10| pi5 switch --\u003e|Access port: VLAN 20| pi4 pfSense # This setup is already good enough, but one of my ideas for experimenting with this lab was to try messing around with open-source solutions for routing. This is both because it seems very interesting and because my ISP\u0026rsquo;s router is hot garbage, which doesn\u0026rsquo;t allow me to do almost anything. The idea to \u0026ldquo;replace\u0026rdquo; it is pretty simple: I would use the Lenovo to host a VM with a pfSense installation, which would act as the \u0026ldquo;entry point\u0026rdquo; for my homelab. Then, since my home network does not need to expose anything to the wider internet, I can insert this router\u0026rsquo;s VM in a demilitarized zone, which has two big advantages:\nThis effectively isolates the router from the rest of my home network, achieving hard segmentation If I were to, in the future, decide to expose a new service on a new VM/port, I don\u0026rsquo;t need to deal with double-NAT shenanigans. Since the DMZ settings make my ISP\u0026rsquo;s router route all the traffic coming from the home network\u0026rsquo;s public IP to pfSense, I just need to set up NAT on the router for the specific machine hosting the service. This means that my final network configuration will be the following:\nflowchart TD subgraph home[Home network: 192.168.0.0/24] router[ISP router] --\u003e|Wi-Fi| repeater[Wi-Fi repeater] router --\u003e home_devices[Home devices] end subgraph homelab[Homelab networks] subgraph lenovo[Lenovo PC: Proxmox host] proxmox[Proxmox] pfsense[pfSense VMWAN: 192.168.0.xVLAN 10 gateway: 192.168.10.1VLAN 20 gateway: 192.168.20.1] end switch[TP-Link switch] subgraph vlan10[VLAN 10: 192.168.10.0/24] docker[Docker VM on Lenovo ProxmoxHomelab services] pi5[Raspberry Pi 5] end subgraph vlan20[VLAN 20: 192.168.20.0/24] pi4[Raspberry Pi 4IoT services] end end repeater --\u003e|WAN / DMZ| pfsense pfsense --\u003e|LAN trunk| switch switch --\u003e|Access port| docker switch --\u003e|Access port| pi5 switch --\u003e|Access port| pi4 This setup almost entirely works: there is still one last problem that needs to be solved, and that is the Pi 4 segmentation. Currently, the diagram shows that the Pi with Home Assistant is isolated from the home network containing the home devices. In order to let Home Assistant bypass this isolation, pfSense needs to be configured with a firewall rule that allows connections only from the Pi to a whitelisted list of IoT device IPs.\nWrapping Up # In the next post I will go into more detail on how this routing will be set up: I will install Proxmox on my Lenovo PC and spin up a pfSense VM manually, then proceed to configure it. In the future I will go back to the setup phase to make it declarative using a combination of OpenTofu and Ansible.\n","date":"20 July 2026","externalUrl":null,"permalink":"/posts/homelab/01-hardware/","section":"Posts","summary":"","title":"Hardware, Placing and Routing","type":"posts"},{"content":"","date":"20 July 2026","externalUrl":null,"permalink":"/categories/homelab/","section":"Categories","summary":"","title":"Homelab","type":"categories"},{"content":"","date":"20 July 2026","externalUrl":null,"permalink":"/","section":"just's blog","summary":"","title":"just's blog","type":"page"},{"content":"","date":"20 July 2026","externalUrl":null,"permalink":"/posts/","section":"Posts","summary":"","title":"Posts","type":"posts"},{"content":" How to Homelab # I\u0026rsquo;d say that homelabbing is by far the best and fastest way to gain confidence with Linux system and system administrator tasks. Want to learn how Docker works? Just take a small, unused laptop, install Linux on it and start experimenting. Want to understand how WireGuard VPNs work? You can configure NAT on your router to expose the server\u0026rsquo;s WireGuard port and see if it works. The possibilities are virtually endless.\nMy Infrastructure # I have homelabbed a lot in the past, mainly with some poor-man\u0026rsquo;s solution. Up until not long ago, my server consisted simply of a very tiny Raspberry Pi 4 with a mere 4 GB of RAM, which allowed me to run only Home Assistant and a couple of Docker services. Then, I was gifted a Raspberry Pi 5 by my girlfriend (yes, I like ARM devices), meaning that I suddenly had a lot more to experiment with (those whopping 16 GB of RAM used to look like a dream to my broke self). Finally, the latest addition to my setup was provided by a friend of mine, who decided to hand me a not-so-old-but-unused Lenovo laptop, which is by far the most powerful component I could ever dream of:\nThe Tools # Once all of these hosts got up and running, a new question arose: how should I split tasks between them? This single doubt (along with some other university tasks) paralyzed my homelab for a couple of months, until I finally decided to lay out a plan to restructure my infrastructure to make it reproducible and clear. To do this, I wanted to explore and adopt three main tools:\nProxmox: arguably my favorite tool of the stack. Proxmox allowed me to make the most of the Lenovo machine by dynamically deploying several VMs on it without the pain of manually managing KVM/LXC. OpenTofu: the FOSS alternative to Terraform, the go-to tool to deploy virtual machines declaratively. Since I will be using Proxmox to deploy VMs, it becomes mandatory to have a tool that makes deployment easier (with OpenTofu, it just becomes tofu apply, sort of). Ansible: once the VMs are deployed, Ansible manages the installation and configuration phases. It works by writing small pieces of YAML configuration files, called playbooks, which serialize a list of instructions to be executed via SSH on a single host. I would use this to, for example, install Docker on a deployed VM on Proxmox. Komodo: a tool that I\u0026rsquo;ve been exploring for a bit with my CTF team to simplify Docker container deployment. Komodo allows you to import Docker Compose stacks from Git and run them in a distributed way. It also supports a Terraform-inspired syntax using TOML to declaratively specify which resources should be loaded into the software. Git: which needs no introduction. The files that describe the final infrastructure will be saved in (hopefully self-hosted) repositories. Forgejo: to store the selfhosted repository and run CI/CD to execute both OpenTofu and Ansible directly inside the infrastructure. The (almost) Final Plan # Now that the tools and the machines are in line, the restructuring plan would become something like this:\nThe main Lenovo server, which we can call from now on \u0026ldquo;Lancelot\u0026rdquo;, will be reserved to Proxmox. The idea is to host on it at least two VMs, using OpenTofu: A Docker machine, which becomes the main playground to host various services using Docker, Ansible and Komodo. A pfSense router, to create an internal subnet for the private Homelab network. Since networking can become a real pain, this part will probably be better described in another post. The Raspberry Pi 5, which we can call from now on \u0026ldquo;Zero\u0026rdquo;, will become a sort-of orchestrator. It will host the Git server and the runner, so that the CI/CD can execute actions directly on Proxmox or the internal VM. The Raspberry Pi 4, which we can call from now on \u0026ldquo;Guren\u0026rdquo;, will be dedicated to running Home Assistant, since it\u0026rsquo;s definitely too tiny to have it host anything else. Yes, the names are borrowed from Code Geass btw.\nThis will be the first post of a series. The following posts will go into more detail on how this plan shall take place. For now, thanks for following :)\n","date":"19 July 2026","externalUrl":null,"permalink":"/posts/homelab/00-planning/","section":"Posts","summary":"","title":"Planning the Homelab","type":"posts"},{"content":" Homelab # Here I document my other passion, which is Sysadmin and Homelabbing in general. I will refill this section once posts start coming!\n","date":"19 July 2026","externalUrl":null,"permalink":"/posts/homelab/","section":"Posts","summary":"","title":"","type":"posts"},{"content":" Cybersecurity # This section keeps track of all of my posts related to Cybersecurity.\nAs of now, I am a student at the University of Cagliari and am following the master\u0026rsquo;s course about Cybersecurity, Artificial Intelligence and Computer Engineering. If you are curious, you can find my University notes at notes.lorecorrias.dev.\nI am also a player for Srdnlen, the University of Cagliari\u0026rsquo;s official CTF team. I specialize in Web security, but I am also interested in Sysadmin tasks, particularly regarding Attack \u0026amp; Defense CTFs.\nLatest Cybersecurity blogposts: ","date":"19 July 2026","externalUrl":null,"permalink":"/posts/security/","section":"Posts","summary":"","title":"","type":"posts"},{"content":"Hello World! My name is Lorenzo and I\u0026rsquo;m a student at the University of Cagliari.\nI\u0026rsquo;m a CyberSecurity student and in 2023 I participated at project CyberChallenge.it, an intensive course of 6 months which provided me a basic understanding of various fields of Information Security, such as network security, website security (the category on which I decided to focus my studies), software security, and much more. Having won the local competition in Sardinia, I had the opportunity to experience the fantastic national competition, where, together with five other teammates, we secured the 5th place nationally against 40 other universities!\nA photo of the team right after the exhausting competition! Once this amazing journey ended I joined the local CTF team, srdnlen, in which I met a lot of wonderful people.\nIn my spare time I have fun managing this kind of side projects, like this little blog, in order to always try and learn new stuff. I would also like to publish my experiments made on my Homelab, a small Raspberry Pi 4 on which I try and install numerous services, to also try and learn how to manage a very little and simplified home network effectively.\nI am currently a student at the University of Cagliari on the Cybersecurity, Artificial Intelligence and Computer Engineering course.\nIf you wish to contact me, all my useful links are inside the bio! Have a nice stay ^^\n","date":"22 December 2023","externalUrl":null,"permalink":"/about/","section":"just's blog","summary":"","title":"whoami?","type":"page"},{"content":"","externalUrl":null,"permalink":"/authors/","section":"Authors","summary":"","title":"Authors","type":"authors"},{"content":"","externalUrl":null,"permalink":"/series/","section":"Series","summary":"","title":"Series","type":"series"},{"content":"","externalUrl":null,"permalink":"/tags/","section":"Tags","summary":"","title":"Tags","type":"tags"}]