ProxLink: Proxmox Home Lab
Table of Contents
Stack: Proxmox VE · OPNsense · NetBird · Technitium DNS · Ubuntu
Docs: proxlink.aditiindre.com
Team: Group project with Dhanraj Chavan. Aditi configured the firewall,
the network segmentation, and the Technitium DNS blocklists.
What it is
A home lab on one Beelink SER5 Pro mini PC (Ryzen 7 5800H, 32 GB RAM, 1 TB NVMe) running Proxmox VE 8 in place of the stock Windows install. Virtual machines sit behind a virtualized firewall, split into separate trust zones.
Network segmentation
Proxmox provides three bridges, one per subnet:
- WAN (
vmbr0, 192.168.1.0/24): the upstream router and internet access - LAN (
vmbr1, 192.168.2.0/24): trusted internal VMs, such as an Ubuntu Desktop - DMZ (
vmbr2, 192.168.3.0/24): semi-trusted, exposed services, such as an Ubuntu Server
Firewall
An OPNsense VM has an interface on each bridge and handles routing between the zones, NAT and port forwarding, and inbound and outbound filtering.
DNS filtering
Technitium DNS Server is the resolver for devices on the LAN and DMZ, handed out by OPNsense over DHCP. Blocklists stop ads, trackers, and malicious domains network-wide.
Remote access
A NetBird routing peer exposes the LAN, and optionally the DMZ, to authorized remote peers over WireGuard. That traffic still passes through OPNsense, so the same firewall rules apply to remote access as to local traffic.