Cybersecurity Home Lab Hardware: $500, $1,000 and $2,000 Builds

A cybersecurity home lab goes wrong fastest when a deliberately vulnerable VM lands on the same flat network as your family’s laptops. Your hardware decides whether you can prevent that. You need a host with enough RAM to keep attacker, targets and SIEM in separate VMs, a switch that speaks VLANs, and a firewall between the lab and your home LAN. Get those three right and the rest is software.

Original content from computingforgeeks.com - post 178045

Below are three home lab builds at $500, $1,000 and $2,000, priced on Amazon on October 27, 2026, in a DDR5 shortage that has pushed a 32GB laptop kit past $530. Each tier’s RAM comes from measuring Kali, a Wazuh SIEM and two vulnerable web apps as Proxmox VMs. All of it was tested in October 2026 on Kali Linux 2026.3 and an Ubuntu 26.04 Wazuh VM, so the sizing reflects the stack you will run.

The three builds and what they cost

Every build carries the same two small parts: a TP-Link TL-SG108E for VLANs and a port mirror, and an Alfa AWUS036ACM for Wi-Fi monitor mode. What changes between tiers is the host, because RAM decides how many VMs you can isolate at once, and at the top tier a dedicated firewall box joins the list.

Tier	Lab host	RAM / cores	Firewall	What it runs	Total (Oct 27 price)
$500	Beelink EQR5	16GB DDR4, 4C/8T	OPNsense VM	Kali, OPNsense, Linux targets (Wazuh in rotation)	about $463
$1,000	Beelink SER8	32GB DDR5, 8C/16T	OPNsense VM	Everything above plus a Windows AD domain	about $933
$2,000	Minisforum MS-A2	32GB DDR5 (96GB max), 16C/32T	Protectli VP2430e	A full AD lab, 10GbE, physical firewall	about $2,078

If you can only buy once, buy the $1,000 build. Its 32GB is the first amount that holds the whole stack, Windows domain included, with no VM shut down to make room. The SER8 listing ships with that 32GB fitted, and buying it separately in late 2026 costs over half the price of the box. The top tier runs about $78 over its label because the Protectli is sold barebone. If you already own the switch and adapter from a lower tier, it comes back to $2,004.

How the builds were picked and tested

We did not have these exact boxes on the bench, so no performance claim below comes from running them. Every spec traces to the manufacturer’s page, every price and stock state to the Amazon Creators API on October 27, and the MS-A2 network details to ServeTheHome’s review. What we measured ourselves is the software side, which is the part that decides how much hardware you need:

• Kali Linux 2026.3 (Xfce) ran as a 4 vCPU, 6GB VM, measured idle and after an nmap 7.99 scan.
• Wazuh 4.14.9 single-node Docker ran on an Ubuntu 26.04.1 VM with 4 vCPU and 12GB.
• DVWA and OWASP Juice Shop ran as containers and were measured within a minute of starting.
• A Windows Server 2025 DC could not be measured, so its figures are Microsoft’s.

Used enterprise servers are out of scope on purpose. A retired 2U box carries more RAM for the money, but its fans and idle draw make it a different decision. Most people building a first security lab want a quiet machine on a desk.

What a security lab stack actually uses

Your SIEM sets the floor, not Kali. Once the three Wazuh containers settled, the indexer alone held 1.36GiB and the whole stack about 2GiB, while a Kali desktop sitting idle used under a gigabyte. This is what docker stats reported on the Wazuh VM once the stack had settled:

docker stats --no-stream --format 'table {{.Name}}\t{{.CPUPerc}}\t{{.MemUsage}}'

Of the three, the indexer is the Java process, capped by the compose file’s -Xms1g -Xmx1g heap, so its resident size sits a little above that cap:

NAME                            CPU %     MEM USAGE / LIMIT
single-node-wazuh.dashboard-1   0.08%     184MiB / 11.68GiB
single-node-wazuh.manager-1     0.38%     487MiB / 11.68GiB
single-node-wazuh.indexer-1     0.98%     1.356GiB / 11.68GiB

Our numbers are for an idle SIEM with no agents reporting, and they are the reason you should not size the VM from them. Wazuh’s Docker documentation asks for at least 4 cores, 8GB of RAM and 50GB of disk for a single-node stack. The gap between 2GiB measured and 8GB documented is what the indexer needs once agents start shipping real logs. Give the SIEM its 8GB and treat it as fixed.

Lab component	Measured in our lab	Budget per VM	Source of the budget
Kali Linux 2026.3, Xfce idle	894MB used at 10 min	4 to 6GB	measured, plus headroom for Burp and browsers
Wazuh 4.14.9 single node	about 2GiB containers, 2.5GB VM used	8GB, 50GB disk	Wazuh documentation
DVWA + Juice Shop	134MiB + 150MiB	2GB	measured
Windows Server 2025 DC	not measured	4GB	Microsoft: 2GB minimum, 4GB recommended
Windows client for the domain	not measured	4GB	our allocation
OPNsense firewall VM	not measured	2GB	our allocation

Add the budgets and the tiers fall out. The Linux half of the lab (Kali, Wazuh, the web targets and OPNsense) books 16 to 18GB. That is more than a 16GB host can give once Proxmox and the integrated GPU’s reserved memory take their share, so on 16GB one of those VMs stays powered off at any time. Add a domain controller and one Windows client and you are at 24 to 26GB, which fits a 32GB host with a few gigabytes left for Proxmox and the iGPU. Microsoft’s hardware requirements list 2GB as the minimum for Windows Server 2025 with Desktop Experience and recommend 4GB, so we budget the recommended figure. Our Proxmox RAM sizing guide covers the host overhead in more detail.

Error: “no space left on device” during the Wazuh pull

Disk ran out before RAM did. The Wazuh VM started from a 20GB cloud image, and pulling the three Wazuh images filled it to 100% before the vulnerable apps could even download. Both docker run commands for DVWA and Juice Shop failed with the same write error:

docker: failed to copy: failed to send write: write /var/lib/containerd/io.containerd.content.v1.content/ingest/<id>/data: no space left on device

Wazuh’s images are about 7.4GB (manager 2.73GB, indexer 2.56GB, dashboard 2.14GB). With Ubuntu’s docker.io storing them through containerd, /var/lib/containerd grew to 15GB, because compressed layers and unpacked snapshots both stay on disk. The Wazuh stack itself stayed up and green, which makes this failure easy to miss until the next pull. Give the SIEM VM the 50GB Wazuh asks for, and buy a host SSD of at least 1TB so snapshots of five or six VMs never put you back here. We moved the two targets onto the Kali VM’s 80GB disk to finish the measurement.

Segmentation comes before hardware

Every build below assumes one layout: a firewall that owns the only link to your home router, a VLAN-aware switch, and three lab segments behind it. Kali lives on an attack VLAN, the SIEM on a monitoring VLAN, and the targets on a VLAN with no route to the internet. Do not skip the firewall rule that blocks the target VLAN from reaching anything outside the lab, because an intentionally vulnerable app with internet access is a compromise waiting for its first scanner.

Our nmap scan from Kali shows why the layout matters. From the attack VLAN, Kali reached every TCP port the single-node Wazuh compose file publishes, including the indexer on 9200 behind basic auth:

nmap -sV -p 80,443,1514,1515,3000,8080,9200,55000 10.0.1.50

Five Wazuh ports answered, and the scan took 98 seconds because of the TLS service probes:

PORT      STATE  SERVICE            VERSION
80/tcp    closed http
443/tcp   open   ssl/https
1514/tcp  open   fujitsu-dtcns?
1515/tcp  open   ssl/ifor-protocol?
3000/tcp  closed ppp
8080/tcp  closed http-proxy
9200/tcp  open   ssl/http           Amazon OpenSearch REST API (Basic auth)
55000/tcp open   unknown
Nmap done: 1 IP address (1 host up) scanned in 98.19 seconds

Wazuh’s stock compose file ships with a default indexer password, and in our lab that password worked against port 9200. Anything on the attack VLAN that reaches 9200 can read your detection data. Change the Wazuh default passwords before the SIEM shares a segment with Kali, and let the firewall pass only agent traffic (1514 and 1515) from the target VLAN. Wazuh documents the Docker password change separately; the package install is in our Wazuh install guide. The OPNsense on Proxmox walkthrough covers the VLAN interfaces.

The $500 build: Beelink EQR5 with 16GB

At this price, upgradability matters more than raw speed, and the EQR5 is the cheapest box we found that its maker documents as upgradable. Beelink lists two DDR4 SODIMM slots that take up to 64GB, so the shipped 16GB is a starting point. Its two 1GbE ports let a firewall VM own one port for WAN and one for the lab trunk.

Amazon sells the Ryzen 3 7330U version (4 cores, 8 threads) with 16GB of DDR4 as two 8GB modules and a 500GB NVMe drive. It was about $389 on October 27, but check the live price, because mini PC listings have moved weekly through the memory shortage. With the shared switch and Wi-Fi adapter the build lands at about $463. At 16GB it has to choose:

• The firewall VM, Kali and the web targets run together on about 8GB, with Wazuh started only when Kali is shut down.
• The second NIC carries the VLAN trunk, so the firewall VM never shares a port with your home LAN.
• The 500GB SSD fits Wazuh’s 50GB request plus Kali and a handful of target images, but not many snapshots.

Skip it if you want the SIEM running all the time or a Windows domain now. The 7330U’s integrated graphics also reserve part of the 16GB, so lower the UMA frame buffer in the BIOS to the smallest setting before you size VMs. The slots take more memory, but a DDR4 upgrade bought today eats most of the gap to the $1,000 tier. The 4-core CPU is also the slowest here, which you will notice when Wazuh’s indexer and a full nmap sweep run together. For a first lab built around Kali and web app testing, it is enough, and the Proxmox and Kali pentest lab build is sized for exactly this kind of box.

The $1,000 build: Beelink SER8 with 32GB

We would buy this one. The SER8 listing ships with 32GB of DDR5-5600 and a 1TB PCIe 4.0 SSD already fitted, and in October 2026 that is the main reason to choose it. The same 32GB as a Crucial kit costs about $537 on its own, more than half the price of the whole SER8.

Its Ryzen 7 8745HS gives you 8 cores and 16 threads, double the $500 build, and that’s what keeps an indexer, a domain controller and an active scan from fighting for CPU. At about $859 on October 27 (check the live price, the listing showed limited stock), the full build with switch and adapter comes to about $933. With 32GB the whole table above fits:

• Kali, Wazuh, the targets, a Windows Server 2025 DC, one Windows client and OPNsense book about 26GB with the 780M’s UMA buffer set low.
• The 1TB SSD holds every VM plus snapshots before each exercise, so you can roll a target back after you break it.
• A second M.2 slot is free for a drive dedicated to Wazuh’s indexer data.

Skip it if you want a firewall VM on its own physical port. The SER8 has a single 2.5GbE port, so OPNsense has to work as a router on a stick, with WAN and the lab VLANs tagged over one cable to the switch. That works with the TL-SG108E, but it means your home LAN and the lab share one wire, and a VLAN mistake on the switch exposes the lab. Add a USB 2.5GbE adapter or step up to the $2,000 tier if that worries you.

The $2,000 build: Minisforum MS-A2 and a Protectli firewall

Spending more here changes the threat model, not just the core count. The firewall moves onto its own fanless box, so a hypervisor bug or a misconfigured bridge on the lab host cannot hand a target VM a path to your home network. The host itself gets 16 cores, two 10GbE SFP+ ports and room to grow to 96GB once memory prices fall.

We priced the Ryzen 9 9955HX model (16 cores, 32 threads) with 32GB of DDR5 and a 1TB SSD. It was about $1,299 on October 27, with limited stock, so check the live price. Minisforum lists two DDR5-5600 SODIMM slots up to 96GB, three M.2 slots including U.2 support, and a low-profile PCIe slot that is x16 in size but wired as PCIe 4.0 x8. ServeTheHome’s review notes that the two 2.5GbE ports are one Intel i226-V and one Realtek RTL8125, and the two SFP+ ports run on an Intel X710.

Pair it with the Protectli VP2430e, which runs OPNsense on four Intel i226-V 2.5GbE ports with an Intel N150, AES-NI and coreboot firmware, and has no fan. It sells barebone at about $469, so add one DDR5 SODIMM and one M.2 2280 NVMe drive. An 8GB Samsung module (about $140) and a 500GB WD Green SN3000 (about $96) brought the firewall to about $705 on October 27. The module runs at DDR5-4800 in this box and the Gen4 SSD at the slot’s Gen3 x2 speed, which is plenty for a firewall.

Both firewall parts are linked here, the Samsung 8GB DDR5-5600 SODIMM and the WD Green SN3000 500GB. Third-party sellers held both listings when we checked, so confirm seller and price on the day. The full tier total, shared switch and adapter included, is in the table at the top. Three things to know before you buy:

• Both MS-A2 SODIMM slots ship filled, so 64GB means replacing the 32GB, and a 64GB Crucial kit cost more than the SER8 on October 27.
• The Protectli has one DDR5-4800 SODIMM slot, so buy the size you want once.
• The MS-A2’s USB-C ports are USB 3.2 Gen 2, not USB4.

Skip this tier if the lab will stay on one person’s desk with Linux targets only. You are paying for physical separation, 10GbE and headroom, and none of that improves a Kali and DVWA lab that already fits in 16GB. It earns its price when the lab grows into an AD forest with several clients, a second Proxmox node, or a mirrored SPAN feed into a sensor.

Gear every tier shares

Segmentation only becomes real at the switch. TP-Link’s V6.40 datasheet lists 802.1Q VLANs (up to 32) and port mirroring for the TL-SG108E. That lets you trunk lab VLANs from the firewall and copy target traffic to a sensor port for Wazuh or Zeek. At about $25 on October 27 it is the cheapest piece of the lab and the one that keeps it apart from your home network.

Treat its management page as exposed, because the web interface is HTTP only and has no dedicated management VLAN. Put the switch’s IP on a port only your admin machine reaches, and change the default password the day it arrives. Mirrored traffic goes to one destination port, which suits a single sensor and nothing bigger.

For wireless testing, Kali needs an adapter that supports monitor mode and packet injection, and a laptop’s built-in card usually does not. The Alfa AWUS036ACM uses the MediaTek MT7612U chipset, which the in-kernel mt76x2u driver supports, so it works on a current Kali kernel with nothing to compile. It was about $49 on October 27 from a third-party seller.

Only test networks you own. Pass the adapter through to the Kali VM as a USB device in Proxmox, and our Kali Wi-Fi adapter comparison covers the alternatives if you need Wi-Fi 6E.

A Raspberry Pi 5 is an optional extra, not a lab host. With 8GB it makes a good drop box or a dedicated sensor on the mirror port. The CanaKit Essentials kit (about $230 on October 27) includes the case, active cooler, USB-C power supply and a 32GB microSD card, so it boots on day one. Its single Gigabit port and microSD storage rule it out for running the SIEM.

Put the Pi on the target VLAN only if it runs nothing but the sensor, because anything else on that segment is a target too.

RAM, disk and NIC choices that decide the lab

A parts list matters less than three numbers on whatever host you pick. If you are shopping outside these three builds, hold any candidate to these checks:

• The host has at least 16GB for a Linux-only lab and 32GB if a Windows domain is on the plan.
• The memory is in SODIMM slots, not soldered, so the lab can grow when prices fall.
• The boot SSD is at least 500GB, and 1TB if you snapshot targets before every exercise.
• The CPU supports AMD-V or VT-x plus an IOMMU, so Proxmox can pass a NIC or USB adapter through.
• The host has two NICs, or you accept a router-on-a-stick firewall over one tagged port.

Memory is the trap in late 2026. Laptop DDR5 now costs enough that a bare box plus separate RAM beats a configured listing on price only by accident. Favour listings that ship with the memory you need, and plan upgrades for when the shortage eases. Our mini PC guide for Proxmox covers more hosts if none of these three fits, and once the hardware is here the Kali Linux install walkthrough is the first VM to build.

Isolation checklist before the first scan

Run through this list after the hardware is cabled and before you point Kali at anything. Each item is a condition you can verify, and the lab is not ready until all of them hold:

1. The firewall is the only device with a cable to your home router.
2. A ping from a target VM to 1.1.1.1 fails, because the target VLAN has no outbound rule.
3. A ping from a target VM to your home LAN subnet fails as well.
4. The Wazuh and TL-SG108E default passwords have been changed.
5. Port 9200 on the SIEM is reachable only from the monitoring VLAN.
6. Each target has a clean Proxmox snapshot taken before its first exploit.
7. The Wazuh VM has at least 50GB of disk, so the next image pull does not fill it.

If check 2 or 3 passes when it should fail, stop and fix the firewall rules first, because every exercise you run after that point is running on your real network. Our DVWA web app pentest guide is a good first exercise once the list is clean.