The surface you don't expose is the one you don't defend. 

Networking 3

• Cisco router: LAN, WAN, DHCP, NATHostname and console hardening, static LAN interface, DHCP pool with exclusions, WAN by DHCP, NAT overload with an ACL — verified by ping from a client.Cisco IOS
• Private datacenter behind an NG firewall in Hyper-VExternal and internal virtual switches, an Untangle (Arista NG Firewall) router VM, and a lab that only reaches the internet through it.Hyper-VUntangle
• Cisco IP CommunicatorSoftphone deployed and configured on the domain over VPN — permissions, audio, registration.VoIP

Zero-trust access 4

• Netbird subnet routerA VM that routes the home LAN into the overlay network. Nothing listens on the open internet.WireGuard
• Vaultwarden behind Cloudflare TunnelSelf-hosted password manager, reachable over HTTPS from anywhere, with no public IP, no open port, no reverse proxy — and a 30-minute rebuild cheat-sheet.Cloudflare
• DNS sink + reverse proxyPi-hole and Nginx Proxy Manager as the LAN's front door.
• Hardened Remote DesktopRDP on a non-default port with the registry, firewall and forwarding changes that go with it — and the reasons not to.RDP

Project Z — detection lab 5

• OPNsense in Hyper-VA virtual firewall carving an isolated lab subnet with outbound-only internet and a bi-directional drop policy toward the parent network.OPNsense
• Kali Linux attacker VMThe controlled adversary: scans, brute-force, exploits — traffic for the rest of the stack to catch.Kali
• Wireshark packet layerGround truth on a domain-joined Windows 11 endpoint: what actually crossed the wire.Wireshark
• Splunk SIEMSplunk Enterprise on Ubuntu with a Universal Forwarder on the domain controller — Security, System and Application logs, searchable.Splunk
• The detection loopKali attacks → OPNsense logs → Wireshark validates → Splunk alerts. Practised end to end.