Build a Cybersecurity Home Lab: Hardware, Hypervisors and Safe Networking
Part 1 of our home-lab series: how much RAM and storage you need, Type 1 vs Type 2 hypervisors, VM vs dual boot, and how to wire lab networks so nothing escapes.
Part of our free Build Your Own Cyber Lab series. Work through it in order, or jump to the part you need.
- Plan your lab: hardware, hypervisors and safe networking (you are here)
- VirtualBox and VMware basics, then Kali, Parrot and Windows 11
- Beyond VirtualBox: Hyper-V, VMware Workstation and Proxmox
- Dual boot Kali Linux and Windows safely
- Ubuntu in your lab: desktop, server, SSH and Docker
- Active Directory lab with Windows Server
- Attack-and-defend network: firewall and vulnerable targets
- Metasploitable 2 and 3: install and first exploits
- Blue-team lab: Wazuh, Sysmon and Security Onion
- Android app testing lab: emulator, MobSF, Frida and Burp
- OT/ICS security lab: OpenPLC, Modbus and an HMI
- Network lab: build it in Packet Tracer or GNS3, read it in Wireshark
Why build a lab at all
Every hands-on certification, from Security+ performance questions to OSCP, assumes you have broken and fixed real systems. A home lab is where that happens without risk: you can install a domain controller, attack it, watch the logs, roll back a snapshot and try again. Interviewers ask about home labs because they show initiative you cannot fake.
What hardware you need
You do not need a server rack. Almost every lab in this series runs on one decent laptop or desktop.
| Resource | Minimum | Comfortable | Why it matters |
|---|---|---|---|
| RAM | 16 GB | 32 GB or more | Each VM reserves its memory. Windows Server plus a Windows client plus Kali is already 10-12 GB. |
| Storage | 256 GB SSD free | 500 GB+ NVMe SSD | VMs on a spinning disk feel unusably slow. Snapshots also consume space. |
| CPU | 4 cores with virtualisation | 6-8 cores | Look for Intel VT-x or AMD-V, and VT-d/AMD-Vi if you want device passthrough later. |
| Network | Built-in NIC | A second NIC or USB NIC | Only needed for network-monitoring labs such as Security Onion. |
Turn on virtualisation in firmware. Most "VT-x is disabled" errors are a firmware setting. Reboot into the UEFI/BIOS setup and enable Intel Virtualization Technology (VT-x) or SVM Mode (AMD), then save and restart.
Type 1 vs Type 2 hypervisors
- Type 2 (hosted) hypervisors run as an application on your normal OS: Oracle VirtualBox, VMware Workstation Pro and Hyper-V on Windows 10/11 Pro (technically Hyper-V sits beneath Windows, but you use it like a desktop app). Best for a single machine you also use day to day.
- Type 1 (bare metal) hypervisors replace the OS on a dedicated box: Proxmox VE, Microsoft Hyper-V Server role, VMware ESXi. Best when you have a spare PC or mini PC that can run 24/7.
Which should you pick? Start with VirtualBox if you are new - it is free, cross-platform and forgiving. Move to Proxmox when you have spare hardware and want a lab that is always on. Use Hyper-V if you already run Windows Pro and want the same platform you will meet at work.
Virtual machines or dual boot?
Virtual machines win for almost every learning purpose: snapshots, isolated networks, several operating systems running at once, and no risk to your main install. Dual boot (part 4) makes sense when you need full hardware access - wireless adapters in monitor mode, GPU password cracking, or a low-RAM laptop that cannot spare memory for a host OS.
Design the lab networks first
Hypervisors offer several network modes. Choosing the right one is the most important safety decision you will make.
| Mode (VirtualBox name) | VMs can reach each other | VMs can reach the internet | Host can reach VMs | Use it for |
|---|---|---|---|---|
| NAT | No | Yes | Only via port forwards | Downloading updates on a single VM |
| NAT Network | Yes | Yes | No | A small lab that needs updates |
| Host-only | Yes | No | Yes | Managing lab VMs from your host |
| Internal Network | Yes | No | No | Vulnerable targets and malware - fully isolated |
| Bridged | Yes | Yes | Yes - VM joins your real LAN | Avoid for anything vulnerable |
A good default layout uses three segments: an internal "attack" network where Kali and the vulnerable targets live, a "corporate" network for the domain controller and Windows clients, and a firewall VM (part 7) routing between them with a controlled path out for updates.
Snapshots are your undo button
Take a snapshot after each clean install and before every risky exercise. Name them clearly ("DC01 - fresh promote", "WIN11 - before mimikatz"). Snapshots are not backups, though: export important VMs to OVA files on another drive occasionally.
Where to get the operating systems legally
- Kali Linux and Parrot OS are free downloads from their official sites, including ready-made VM images.
- Windows 11 and Windows Server are available as free time-limited evaluations from the Microsoft Evaluation Center - ideal for labs you rebuild regularly.
- Ubuntu (part 5) is free and makes the ideal Linux server, Docker host and SIEM base.
- Deliberately vulnerable machines such as Metasploitable, OWASP Juice Shop and DVWA are covered in parts 7 and 8.
Keep it legal and contained
Only attack machines you own or have written permission to test. Vulnerable VMs and malware samples belong on an isolated network with no route to your home LAN or the internet, and never expose a deliberately vulnerable machine with a bridged adapter or a port forward.
Next step
Head to part 2 and build your first VirtualBox lab with Kali, Parrot and Windows 11. When you are ready to practise on real scenarios, our hands-on labs run in the browser with nothing to install.
Sources & References
Daniel Agrici
CEH, Security+, PenTest+
Daniel is the founder of CyberCertPrep. With a background in penetration testing and security consulting, he has passed 8 cybersecurity certifications and writes about exam strategies and career development.
Ready to start practicing?
86 certifications. 157,000+ questions. 20 free per cert.