Design overview

I am designing a virtual cybersecurity lab on an Apple Silicon Mac to learn how networking, identity, applications, monitoring, and incident response work together. Four private networks will separate management, services, security tools, and intentionally vulnerable targets. I will build and test each part in stages so the environment remains practical on a 24 GB Mac.

Virtualization and networking

UTM will host ARM64 virtual machines. An Ubuntu router will provide DHCP, DNS, routing, NAT, and nftables firewall rules between the four networks. I will verify allowed and blocked connections with packet captures and firewall counters. A separate 802.1Q exercise will demonstrate VLAN tags, access ports, and trunks.

Services and identity

An Ubuntu services VM will run Docker Compose applications, with Portainer for container management. Planned services include SSH, local DNS names, an internal HTTPS site, a private certificate authority, and LDAP users and groups. Short exercises will add internal mail, NFS file sharing, and a virtual printer. A Samba Active Directory setup and Windows 11 ARM client are possible later additions.

Security testing

An isolated target network will host DVWA and, if compatible, bWAPP and a VulnHub challenge. Kali and Metasploit will test only these lab targets. Nessus Essentials will identify findings that I can check, fix, and rescan. Caldera will generate controlled activity for detection testing.

Monitoring and incident response

Suricata and packet captures will show traffic crossing the router; Zeek is a possible extension. Wazuh will collect host events and alerts. I will investigate selected alerts in TheHive, use Cortex to examine safe observables, document the timeline and evidence, and verify a fix before closing a simulated case.

Automation and recovery

Git will track sanitized diagrams, configurations, scripts, and notes. Shell scripts and Ansible will repeat setup and health checks. I will also introduce safe failures, diagnose them using logs and traffic, restore services from backups, and retest them from another network.

Cloud comparison

I will map this local design to AWS, Azure, and Google Cloud networking, identity, firewall, and logging concepts. Small deployments in each cloud are optional; the core lab runs on the Mac.

Planned technology

UTM, Ubuntu ARM64, Linux networking, nftables, dnsmasq, Docker Compose, Portainer, LDAP, TLS, Git, Ansible, Kali, Metasploit, DVWA, Nessus Essentials, Caldera, Suricata, Wazuh, TheHive, Cortex.

Possible extensions

bWAPP, VulnHub, Zeek, Samba Active Directory, Windows 11 ARM, AWS, Azure, Google Cloud.

Design goals

  • Network segmentation
  • Subnetting and VLANs
  • Firewall policy
  • Service administration
  • Identity and certificates
  • Vulnerability validation
  • Detection
  • Incident response
  • Automation
  • Backup and restore