Proxmox VE Lab Architecture & Topology
The articles, PowerShell modules, and Active Directory runbooks on this site are never hypothetical. Every script, GPO baseline, and Kerberos flow is exercised inside a private, hardware-isolated Proxmox VE 8.x testbed on a Dell OptiPlex platform, segmented via a multi-bridge pfSense virtual router with zero ingress exposure to the public internet.
Compute & Storage Plane
Dedicated Dell OptiPlex bare-metal host running Proxmox VE. Dual-tier storage configuration isolating hypervisor OS binaries from virtual machine disk datastores.
| Hardware Node | Dell OptiPlex Platform |
| Hypervisor | Proxmox VE 8.x |
| Datastore Tier | Dedicated VM Datastore + local-lvm |
| Disk Interface | VirtIO-SCSI Single (qcow2) |
| CPU Policy | x86-64-v2-AES (Hardware Virtualization) |
pfSense Router & Bridges
Dedicated virtual pfSense appliance acting as the security perimeter, utilizing 4 distinct virtual network bridges to enforce strict zero-trust segmentation.
| Gateway Router | pfSense CE Appliance |
| Uplink Segment | vmbr0 (Outbound NAT Only) |
| Identity Tier | vmbr1 (Domain Controllers & PKI) |
| Management Tier | vmbr2 (Admin Jumpbox & Endpoints) |
| Observability Tier | vmbr3 (Prometheus & Workloads) |
Enterprise AD Environment
Production-representative multi-DC forest separating directory authentication, certificate services (AD CS), and dedicated administrative jumpboxes.
| Primary DC | DC-01 (FSMO Role Holder / PDCe) |
| Replica DC | DC-02 (KCC Topology & DFSR Partner) |
| PKI / CA | Dedicated Enterprise Subordinate CA |
| Admin Jumpbox | Tier-1 Management Server (RSAT / JEA) |
| Validation Client | Windows 10/11 Enterprise Endpoint |
| Tier | Workload Class | Architectural Responsibility | Virtual Network Bridge | Access Policy |
|---|---|---|---|---|
| Perimeter | Boundary Gateway | pfSense Firewall & DNS Resolver | vmbr0 / vmbr1 / vmbr2 / vmbr3 | Strict Boundary |
| Tier 0 | Primary Domain Controller | PDC Emulator, RID Master, Kerberos KDC | vmbr1 (Identity Mesh) | Isolated |
| Tier 0 | Replica Domain Controller | AD Replication Partner, DFSR SYSVOL Sync | vmbr1 (Identity Mesh) | Isolated |
| Tier 0 | Enterprise Certificate Authority | AD CS, LDAPS, Kerberos PKINIT Issuance | vmbr1 (Identity Mesh) | Isolated |
| Tier 1 | Management Server | RSAT Console, PowerShell JEA Endpoint | vmbr2 (Management) | Admin Only |
| Tier 2 | Windows Enterprise Client | GPO Client-Side Extensions, Kerberos Testing | vmbr2 (Endpoints) | Segmented |
| Services | Prometheus Observability | Infrastructure Telemetry & Node Metrics | vmbr3 (Monitoring) | Internal Only |
| Services | Automation Workers & APIs | Automated Background Tasks & App Services | vmbr3 (Workloads) | Internal Only |
[ Outbound NAT Gateway ] (Zero Inbound Exposure)
│
▼
┌─────────────────────────────────────────────────────────────────────────────┐
│ Proxmox VE Hardware Node (Dell OptiPlex Platform · PVE 8.x) │
│ │
│ ┌─────────────────────────────────────────────────────────────────────┐ │
│ │ pfSense Boundary Appliance (4 Isolated Linux Virtual Bridges) │ │
│ └──────┬──────────────────┬──────────────────┬──────────────────┬─────┘ │
│ │ (vmbr0: Uplink) │ (vmbr1: Identity)│ (vmbr2: Mgmt/End)│ (vmbr3) │
│ │ │ │ │ │
│ ▼ ▼ ▼ ▼ │
│ [Outbound NAT] ┌───────────┐ ┌───────────┐ ┌─────────────┐ │
│ │ DC-01 │ │ Mgmt-Host │ │Prometheus │ │
│ │ (PDCe) │ │ (Jumpbox) │ │ (Metrics) │ │
│ ├───────────┤ ├───────────┤ ├─────────────┤ │
│ │ DC-02 │ │ Client │ │Automation │ │
│ │ (DFSR) │ │ (Windows) │ │ Workers │ │
│ ├───────────┤ └───────────┘ └─────────────┘ │
│ │ CA Tier │ │
│ │ (AD CS) │ │
│ └───────────┘ │
│ │ │
│ └── Isolated Inter-DC Replication & LDAPS │
└─────────────────────────────────────────────────────────────────────────────┘
Lab Design & Validation Principles
Operational PostureHosting Active Directory Certificate Services (AD CS) on a Domain Controller is an acknowledged enterprise security hazard. In this lab, the Certificate Authority is segregated from the Domain Controllers, enabling authentic testing of Enterprise Subordinate CAs, Kerberos PKINIT, and LDAPS without compromise.
Scripts authored on karanth.ovh are never run against a single isolated DC. Having both DC-01 and DC-02 ensures that KCC partner topology creation, metadata cleanup, and DFSR SYSVOL consistency are proven to function across real domain controller boundaries.
Running enterprise-grade identity topologies on a single Dell OptiPlex requires meticulous resource discipline—managing ballooning memory, VirtIO SCSI controllers, and CPU thread distribution. This operational constraint forces every PowerShell automation script to be lightweight, efficient, and leak-free.