What hardware do I need for a home network lab?

For container labs, any computer that runs Docker is enough; 8 GB of RAM handles a dozen small containers. VM-based labs need more RAM, about 512 MB to 2 GB per Linux VM, and hardware virtualization enabled.

What is the best first network lab?

Two LANs joined by one Linux router. It teaches IP addressing, subnets, default gateways and forwarding, which every other lab builds on.

Do I need real switches and routers?

No. Linux bridges handle VLANs and trunks, and FRR runs OSPF and BGP in containers. Real hardware helps for vendor-specific CLI and for physical cabling skills, but it is optional.

Can I run these labs on a Mac?

Yes for container labs, through Docker Desktop. VM labs work on Intel Macs with VirtualBox; on Apple Silicon you need ARM images and a provider that supports them.

12 network lab ideas for your home lab

Here are twelve lab projects you can build at home, ordered roughly from first steps to advanced. For each one you get what it teaches, what it needs to run, and how hard it is. Where we have a tested, step-by-step tutorial, the idea links to it.

Most of these run on one laptop with Docker. None of them need real network gear.

At a glance

#	Lab	Difficulty	Runs on
1	Two LANs and a Linux router	Beginner	VMs (Vagrant) or containers
2	Packet capture on every link	Beginner	Docker
3	A bad WAN link	Beginner	Docker
4	DHCP and DNS for the lab	Beginner	Docker
5	VLANs and router-on-a-stick	Intermediate	Docker
6	OSPF with three routers	Intermediate	Docker + FRR
7	DMZ with an nftables firewall	Intermediate	Docker
8	Site-to-site VPN with WireGuard	Intermediate	Docker
9	IPv6 alongside IPv4	Intermediate	Docker + FRR
10	Monitoring and central logging	Intermediate	Docker
11	eBGP between three ASes	Advanced	Docker + FRR
12	Isolated security practice lab	Advanced	Docker, VMs optional

1. Two LANs and a Linux router

The first lab everyone should build: two subnets, one host in each, and a Linux machine routing between them.

What you learn: IP addressing, default gateways and static routes, why IP forwarding must be on, and how to read ip route and traceroute.
What it needs: three VMs with Vagrant and VirtualBox (about 1.5 GB of RAM), or three containers.
Difficulty: Beginner.
Tutorial: A multi-VM network lab with Vagrant.

2. Packet capture on every link

Before you build bigger labs, learn to see what crosses the wire.

What you learn: tcpdump filters, Wireshark, ARP, the TCP handshake, and how to capture inside a container's network namespace.
What it needs: Docker, tcpdump, and Wireshark on your desktop.
Difficulty: Beginner.
Tutorial: Capture a Docker container's traffic with tcpdump and Wireshark.

3. A bad WAN link

Real links have delay, jitter and loss. Add them on purpose and watch applications react.

What you learn: how latency affects TCP throughput, what 1% loss does to a download, and how to shape bandwidth with tc.
What it needs: two containers with the NET_ADMIN capability.
Difficulty: Beginner.
Tutorial: Simulate latency, jitter and packet loss with tc netem.

4. DHCP and DNS for the lab

Replace static addresses with a DHCP server, and give every lab host a name.

What you learn: the DHCP exchange (discover, offer, request, acknowledge), leases, DNS records and how resolvers work.
What it needs: a container running dnsmasq, which does both DHCP and DNS, plus a few client containers. Docker gives containers their addresses itself, so use VMs as DHCP clients, or remove the Docker-assigned address in a client container before you run a DHCP client in it.
Difficulty: Beginner. Capture the DHCP exchange with idea 2 to see each message.

5. VLANs and router-on-a-stick

One switch, several VLANs, and a router with one trunk link serving all of them.

What you learn: 802.1Q tags, access and trunk ports, Linux bridge VLAN filtering, and inter-VLAN routing with subinterfaces.
What it needs: Docker and containers with NET_ADMIN; one container acts as the switch.
Difficulty: Intermediate.
Tutorial: VLANs and 802.1Q trunks on Linux.

6. OSPF with three routers

Swap static routes for a routing protocol and watch routers learn the network.

What you learn: OSPF neighbors and adjacencies, areas, the link-state database, route costs and convergence after a link fails.
What it needs: Docker and the FRR image; three routers and two LANs.
Difficulty: Intermediate.
Tutorial: Build an OSPF lab with FRR in Docker.

7. DMZ with an nftables firewall

Three zones (inside, DMZ, outside) and a firewall that decides what crosses them.

What you learn: stateful filtering, default-deny policies, NAT and port forwarding, and how to test a rule set from each zone.
What it needs: Docker; a firewall container with three interfaces and one host per zone.
Difficulty: Intermediate.
Tutorial: Build a DMZ lab with an nftables firewall.

8. Site-to-site VPN with WireGuard

Two "offices" connected across a simulated internet through an encrypted tunnel.

What you learn: tunnel interfaces, public keys, allowed IPs as a routing table, MTU problems, and what encrypted traffic looks like in a capture.
What it needs: two gateway containers with NET_ADMIN and WireGuard support in the host kernel, plus one host behind each. The WireGuard quick start covers the commands.
Difficulty: Intermediate. Combine it with idea 3 to see how a tunnel behaves on a lossy link.

9. IPv6 alongside IPv4

Take a working IPv4 lab and add IPv6 to every link.

What you learn: IPv6 addressing and prefixes, link-local addresses, neighbor discovery instead of ARP, router advertisements, and running OSPFv3 next to OSPFv2.
What it needs: the OSPF lab from idea 6, with IPv6 turned on for its Docker networks.
Difficulty: Intermediate.

10. Monitoring and central logging

Give the lab a place where every device reports.

What you learn: syslog, metrics collection, dashboards, and how to tell from the data that a link or service is down.
What it needs: Docker; a syslog collector or a metrics stack such as Prometheus with Grafana, and the devices from any earlier lab sending to it.
Difficulty: Intermediate.

11. eBGP between three ASes

The protocol of the internet, in three containers.

What you learn: autonomous systems, eBGP sessions, prefix advertisement, AS paths, route filters, and how a failure reroutes traffic through another AS.
What it needs: Docker and FRR; one router per AS and point-to-point links.
Difficulty: Advanced, mostly because filters and policies take practice.
Tutorial: eBGP between FRR routers in Docker.

12. Isolated security practice lab

A safe place to learn how attacks look from the defender's side.

What you learn: network isolation, how scans and web attacks show up in logs and captures, and the basics of detection.
What it needs: Docker with an internal network, an intentionally vulnerable target such as DVWA, an attacker box and a sensor. VMs for whole vulnerable operating systems.
Difficulty: Advanced, because isolation mistakes matter here. Only test what you own.
Tutorial: Build a cybersecurity practice lab.

How to get the most out of them

Write the plan first. A small diagram with subnets and addresses saves most of the debugging.
Break things on purpose. Each lab teaches more when you remove a route or a VLAN and find the fault yourself.
Keep labs as files. A Compose file or Vagrantfile in Git lets you rebuild a lab in minutes and compare versions.
Combine them. The OSPF lab plus the firewall plus a bad link is close to a small company network.
Check your hardware for VMs. If you want vendor router images later, read nested virtualization explained before you buy anything.

Draw your next lab

Isothrum's editor is a free browser tool, with no account, for drawing a network lab like any of these: containers from any Docker image, Linux and Windows VMs, switches with VLANs and trunks, and FRR or your own Cisco images as routers. You can set latency, jitter, loss and bandwidth on each cable. It exports Docker Compose, Vagrant, Proxmox, Kubernetes and cloud files that you run yourself.