I built an enterprise network out of surplus hardware, broke into it, and caught myself doing it.

This page is laid out the way the network is: by depth. Every section below is a real segment with its own trust boundary, and each project sits at the depth it actually runs at. The surface is the management plane — five machines sourced from university surplus and spare parts, running a three-node Proxmox cluster with a redundant Corosync ring on a dedicated cable mesh. Two of those machines share one case I 3D-printed for them. 136 GB of RAM for roughly a quarter of retail.

Nothing crosses between the management plane and the range except what I explicitly allow. The range rides as tagged VLAN 40 over each node's existing uplink, with no switch SVI — so the switch itself can never route into it. OPNsense is the only gateway, running default-deny, with a small number of narrow, source-restricted exceptions. Every one of those exceptions was verified in both directions: the allowed host reaches the service, and a different host on the same subnet times out.

Rule verification · source restriction enforced, not just configured
osiris  $ curl -sk https://range-svc:55000/
HTTP 401 Unauthorized   # path works — no creds sent, as expected

heavy   $ curl -sk --max-time 10 https://range-svc:55000/
curl: (28) Connection timed out   # different host, same subnet: blocked

An enterprise network in miniature, deliberately built wrong in specific, documented ways. A Windows Server domain with Kerberoastable service accounts, an AS-REP roastable user, an over-permissioned help desk group, unconstrained delegation, and a misconfigured certificate template. Wazuh watches all of it. The point is not that it's vulnerable — it's that every vulnerability is one I chose, placed, and can explain.

The malware lab is the one machine that is not part of the cluster, on purpose. Clustering it would mean heartbeat traffic, shared storage paths, and live migration between the detonation host and everything else — which would quietly undo the isolation that is the entire point of it. So Hades stands alone, and its detonation bridge has no physical uplink and no host IP at all.

Egress test from inside the detonation network
$ ping -c1 8.8.8.8          # the internet
   1 packets transmitted, 0 received   exit 2

$ ping -c1 192.168.50.1     # the management plane
   1 packets transmitted, 0 received   exit 2

$ ping -c1 10.40.40.1       # the range next door
   1 packets transmitted, 0 received   exit 2

Bridge has no physical port. Host has no IP on it. ip_forward=0. No NAT, no route.