// Microsoft Azure · OpenVPN · Pi-Hole · InsightVM · Grafana · Prometheus
// 01 — Architecture
// 02 — Technology Stack
// 03 — Security Hardening
// 04 — Live Dashboards
// 05 — Problem Solving
| Problem | Root Cause | Fix Applied |
|---|---|---|
| Phone internet not working | redirect-gateway commented out |
Uncommented in server.conf |
| No internet after VPN enabled | Missing NAT MASQUERADE rules | Added iptables POSTROUTING rules |
| DNS not resolving on VPN | Pi-Hole listeningMode=LOCAL |
Changed to listeningMode=ALL |
| Slow VPN speeds | AES-256-CBC cipher mismatch | Upgraded to AES-256-GCM + data-ciphers |
| Ubuntu VPN not connecting | Cipher negotiation failure (CBC vs GCM) | Added data-ciphers line to .ovpn file |
| IP subnet conflict | Pi-Hole DHCP using 10.10.0.x range | Disabled Pi-Hole DHCP server |
| Grafana showing no data | Dashboard hostname variable wrong | Fixed node variable to 10.1.0.4 |
// 06 — Outcomes
// 07 — Enterprise Application
This home lab mirrors real enterprise security architecture patterns. Every component maps directly to tools and practices used in Fortune 500 security teams — just at smaller scale. Here's how each piece translates to an enterprise environment.
OpenVPN at this scale demonstrates understanding of full-tunnel routing, PKI certificate management, and NAT — the same concepts used in Cisco AnyConnect, Palo Alto GlobalProtect, and Zscaler deployments.
Pi-Hole demonstrates DNS-layer threat intelligence — the same principle behind Cisco Umbrella, Palo Alto DNS Security, and Cloudflare Gateway used to block malware C2, phishing, and data exfiltration.
InsightVM is an enterprise-grade tool used by thousands of organisations. This lab demonstrates scanner deployment, scan policy configuration, credential management, and asset discovery — core VM skills.
Grafana + Prometheus demonstrates metrics-based observability — a foundation for security dashboards. This architecture maps directly to Splunk, Elastic SIEM, Microsoft Sentinel, and Datadog Security.
The dual-layer NSG + iptables approach mirrors enterprise defence-in-depth: cloud security groups (AWS SGs, Azure NSG) combined with host-based firewalls — exactly as required by CIS benchmarks.
Deploying, hardening, and operating services on Azure demonstrates practical cloud security skills — IAM, network controls, identity, and monitoring — all mapped to real-world cloud security frameworks.
// Home Lab → Enterprise Mapping
| Capability | This Lab (Home) | Enterprise Equivalent |
|---|---|---|
| Remote Access VPN | ✓ OpenVPN + PKI | Cisco AnyConnect · Palo Alto GlobalProtect · Zscaler |
| DNS Threat Filtering | ✓ Pi-Hole v6 FTL | Cisco Umbrella · Cloudflare Gateway · Infoblox |
| Vulnerability Management | ✓ InsightVM (Enterprise) | Tenable.io · Qualys VMDR · Rapid7 InsightVM (same) |
| Metrics & Dashboards | ✓ Prometheus + Grafana | Splunk · Datadog · Microsoft Sentinel · Elastic SIEM |
| Cloud Firewall | ✓ Azure NSG | AWS Security Groups · GCP Firewall · Azure Firewall Premium |
| Host Firewall | ✓ iptables (13 rules) | CrowdStrike Falcon · SentinelOne · Windows Defender Firewall |
| Network Encryption | ✓ AES-256-GCM end-to-end | IPSec · MACsec · TLS 1.3 everywhere |
| Certificate Auth | ✓ Custom PKI / easy-rsa | Active Directory CS · HashiCorp Vault PKI · AWS ACM |
| Identity & Access | ~ IP-based VPN auth | Azure AD / Entra ID · Okta · PingIdentity · MFA |
| Automated Response | ✗ Manual remediation | Splunk SOAR · Palo Alto XSOAR · Microsoft Sentinel playbooks |
| Log Management | ~ journalctl + openvpn.log | Elastic Stack · Splunk · Azure Monitor Log Analytics |
| Infrastructure as Code | ✗ Manual deployment | Terraform · Ansible · ARM Templates · Pulumi |
// Scaling Path
// Enterprise Value Metrics
This lab demonstrates hands-on proficiency with the same tools, concepts, and architecture patterns used in enterprise security teams. Every component was deployed, broken, debugged, and hardened — not just read about.