If you're practicing offensive security at home, the lab must be provably isolated — not "probably fine." Mine runs a dedicated Kali VM on a bridge with no physical uplink, behind a VyOS firewall segment built default-deny.

Design

  • Hypervisor bridge with no physical NIC attached — the segment only exists behind the router
  • Dedicated /24 with the router as the only way out
  • Firewall ruleset: internet egress allowed, all routes to the home LAN dropped
  • VPN egress (WireGuard) for external lab work, toggled manually — not always-on

Prove the isolation

The rule that matters isn't the one you wrote — it's the one the packets hit. Verification was empirical: from the lab box, internet reachable; every host on the home LAN, 100% packet loss; firewall counters incrementing on the drop rule while the tests ran. Screenshots and counters, not assumptions.

Operational discipline

  • Credentials for lab systems stored outside the lab, rotated when exposed
  • Scheduled patching for the attack box — offensive tooling is still software with CVEs
  • Storage watchdogs, because a full thin-pool takes down the lab exactly when you're mid-exercise

Practice targets are authorized-only: TryHackMe rooms (SSRF, IDOR, security fundamentals), intentionally vulnerable apps like DVWA and Juice Shop, and my own infrastructure. The habit that transfers to real network security work isn't the exploit — it's the segmentation, the verification, and the discipline.