Design: A 30-Segment Enterprise-Style Range on Two Mini PCs
Grouping ~30 segments into enterprise trust zones, a readable addressing scheme, and the rules that keep hypervisors out of workload segments.
Status, up front
The core segments (management, transit, DNS, SOC, CTI, AD, DevSecOps, vulnerable apps, attacker, storage, AI) are built and routed. The industry verticals are planned.
Grouping principle
Segments are grouped by trust zone, the way an enterprise does it, not numbered as "lab 1, lab 2":
| Zone | Segments | Example stacks |
|---|---|---|
| Infrastructure | management, transit, DNS, storage, monitoring | pfSense, VyOS, Pi-hole, TrueNAS, observability |
| Defense | SOC, CTI, DFIR | Security Onion, MISP, OpenCTI, SIFT, REMnux |
| Identity | AD/corp, IAM | Windows Server DC, member servers |
| Engineering | DevSecOps/K8s, product security, dev | k3s, Gitea, Jenkins, RHEL, Debian |
| Offense | attacker, vuln-apps, victims | Kali, Parrot, Metasploitable, VulnHub, Vulhub |
| Verticals (planned) | AI/ML, cloud, ICS/SCADA, telecom, automotive, medical, finance | per-domain OS and protocol stacks |
Addressing scheme
A /16 for the lab, one /24 per segment, with the third octet equal to the VLAN ID, and .1 always the VyOS gateway. You can read any address and know its segment. (The real values stay off this site.)
Rules that make it work
- Hypervisor management never moves. VMs get tagged virtual NICs; hosts stay on management.
- One router owns east–west (VyOS); the edge firewall owns north–south (pfSense). See W03 for what happens when the paths disagree.
- Target: default-deny between zones, opened per flow as each service needs it. Inter-segment routing started open for bring-up and is being tightened zone by zone.
- Offense is contained, not crippled. Attacker segments keep flexible DNS and egress for realistic testing, and can't reach management.
- Every segment exists in four places: switch, bridge, router, firewall. Missing one gives you "unreachable" (W06).
Capacity reality
Two 32 GB mini PCs can't run 30 segments' worth of workloads at once, and they don't need to. The lab runs by role: the infrastructure is always on, and the vertical a given week's work needs gets powered up. The T320 (96 GB) was added when the defensive stack alone started crowding out the infrastructure.
Sources: VLAN subnet OS stacks (20 Nov 2025), Network rebuild guide (5 Dec 2025), CyberDen Resource Planning (10 Feb 2026), Sovereign Cyber-Physical R&D (20 Jan 2026)