ko0ler/homelabGNS3 home lab documenting a segmented network with Cisco ASAv firewall, L3 core, DMZ, and an Active Directory domain for practicing networking, sysadmin, and offensive security.
HomeLab is a GNS3 lab built on a single laptop (OMEN 16, i7-14650HX, 32 GB RAM, RTX 4060 8 GB) to practice networking, systems administration and offensive security in one environment. It models a perimeter with a DMZ (Cisco ASAv), a routed core (SW-L3 + two access switches), and an Active Directory domain kooler.local running on Windows Server 2025. Attacker platforms (Kali, ParrotOS/Exegol) sit on the untrusted outside segment alongside a NAT gateway to the internet.
Chain: Kali/Exegol + NAT (Switch-X) → Router → ASAv Firewall (with DMZ leg) → SW-L3 → L2-SW-1 / L2-SW-2 (VLANs).
| Segment | Subnet | Notes |
|---|---|---|
| Outside / untrusted | 192.168.160.0/24 | Switch-X: Kali/Exegol, NAT cloud; Router at .100 |
| Router ↔ FW outside | 10.10.3.0/29 | Router .1, ASA outside .2 |
| FW ↔ DMZ | 10.10.2.0/30 | ASA dmz .2, Ubuntu .1 |
| FW ↔ SW-L3 (inside) | 10.10.1.0/30 | ASA inside .2, SW-L3 .1 |
| VLAN 30 | 192.168.30.0/24 | PC-C, PC-D |
| VLAN 40 | 192.168.40.0/24 | behind L2-SW-2 — Windows 10, PC-B |
| VLAN 50 | 192.168.50.0/24 | behind L2-SW-1 — Windows Server 2025 (DC01), PC-A |
| VLAN 100 | 192.168.100.0/24 | SVI present on SW-L3; trunked, not yet in ASA object group |
Trunk links SW-L3 ↔ L2-SW-1/L2-SW-2 carry VLANs 30, 40, 50, 100 (native VLAN 999, dot1q).
| Device | Role | Platform | Key interfaces |
|---|---|---|---|
| Router | Edge router, NAT-side gateway | Cisco IOSv 15.9 | Gi0/0 10.10.3.1/29 (to FW); Gi0/1 192.168.160.100/24 (to Switch-X) |
| FW | Perimeter firewall, DMZ | Cisco ASAv 9.22(1)1 | outside 10.10.3.2/29; dmz 10.10.2.2/30; inside 10.10.1.2/30 |
| SW-L3 | Core L3 switch, inter-VLAN routing | Cisco IOSv L2 15.2 | Gi0/0 10.10.1.1/30 (to FW); Gi0/1-0/2 trunks to L2-SW-1/2; SVIs for VLAN 30/40/50/100 |
| L2-SW-1 | Access switch | Cisco IOSv L2 15.2 | VLAN 50 access ports (WinServer2025, PC-A) |
| L2-SW-2 | Access switch | Cisco IOSv L2 15.2 | VLAN 40 access ports (Windows 10, PC-B); VLAN 30 (PC-D) |
ASAv is licensed under Smart Licensing Using Policy, running in Evaluation Mode with feature tier standard and throughput level 1G declared locally (no CSSM registration).
| Host | OS / Build | Hostname | IP / VLAN | Services |
|---|---|---|---|---|
| Kali | Kali Linux 2026.2 (VMware amd64) | Kali | 192.168.160.130 (outside segment) | Attacker platform |
| ParrotOS/Exegol | ParrotOS + Exegol | — | outside segment (Switch-X) | Attacker platform |
| Ubuntu | Ubuntu Desktop 26.04 | ko0ler-VMware-Virtual-Platform | 10.10.2.1 (DMZ) | DVWA, bWAPP, httpbin, FTP, Samba, MySQL |
| WindowsServer 2025 | Windows Server 2025 | DC01 | 192.168.50.10 (VLAN 50) | ADCS, ADDS, DHCP, DNS, MSSQL — domain controller for kooler.local |
| Windows 10 | Windows 10 | PC1 | DHCP (VLAN 40) | Domain-joined workstation |
| PC-A | VPCS | — | VLAN 50 (.15) | — |
| PC-B | VPCS | — | VLAN 40 (.15) | — |
| PC-C | VPCS | — | VLAN 30 (.1) | — |
| PC-D | VPCS | — | VLAN 30 (.2) | — |
Domain controller: DC01 (Windows Server 2025, 192.168.50.10), running ADCS, ADDS, DHCP, DNS and MSSQL side by side — a deliberately over-provisioned DC for attack-surface practice (service account exposure, ADCS template misconfig, SQL on a DC, etc.).
| Account | Scope | Notes |
|---|---|---|
| Administrator | Local (DC01) | Built-in local admin |
| Ko0ler | Domain user | — |
| user1 | Domain user | — |
Windows 10 (PC1) is joined to kooler.local; local login ko0ler also exists on that machine separate from the domain account.
| Zone pair | Direction | Allowed |
|---|---|---|
| outside → DMZ | inbound | HTTP(80), HTTPS(443), 8080, 8070, 8060 to Ubuntu (10.10.2.1); ICMP |
| DMZ → outside | outbound | HTTP, HTTPS, DNS(53) |
| DMZ → inside | — | denied |
| inside → DMZ | outbound | full IP to Ubuntu |
| inside → outside | outbound | full IP, PAT via ASA outside interface |
NAT: PAT for inside subnets (192.168.30/40/50.0/24, dynamic, via ASA outside) and static NAT for the DMZ host (10.10.2.1 → 10.10.3.3, DMZ_MAPPED). Note: inter-VLAN traffic between VLANs 30/40/50 never crosses the ASA — SW-L3 routes it locally, so the firewall only sees north-south (DMZ/outside) traffic.
Tracked in CHANGELOG.md.
Lab credentials are intentionally not committed to this repository.
| Scope | Account | Host |
|---|---|---|
| Local | kali | Kali |
| Local | ko0ler | Ubuntu |
| Local | ko0ler | Windows 10 (PC1) |
| Local | Administrator | DC01 |
| Domain (kooler.local) | Ko0ler | — |
| Domain (kooler.local) | user1 | — |
