Lion Cipher Lab
Segment your home network the zero-trust way (and prove it actually works)
- Cyber / Security Engineer
- Intermediate
- ~2-3 hours
- Free · no account required
Why it matters
Almost every home network is flat: the smart bulb, the baby monitor, your work laptop and your NAS full of tax documents are all in one room with no walls. That means the weakest device on your network — usually a cheap IoT gadget that stopped getting firmware updates in 2021 — is one hop away from everything you care about. "Zero trust" is the industry's answer, and it is normally taught as a slide full of buzzwords. This lab makes it physical: you will draw the zones, build them on the gear you already own, and then spend most of your time trying to break through your own walls to prove…
What you'll learn
- network segmentation
- zero trust architecture (NIST SP 800-207)
- VLANs and subnets
- firewall rule ordering and default deny
- guest network / client isolation on consumer routers
- verifying isolation with nmap
- east-west traffic control
- documenting a network design
Steps in this lab
- Before anything: the one rule, and the realistic way this goes wrong
- The words you need first — every term, from zero
- What zero trust actually says — and what it doesn't
- Draw the network before you touch it — inventory and zones
- Find your router and log in (start here if you never have)
- Take the "before" picture: map your flat network while it's still flat
- PATH A — the guest network: real segmentation on the router you already own
- PATH B — VLANs: the fuller build, if you have the kit
- PATH B — write default deny between segments (and the rule-order trap)
- THE PROOF — three tests that actually demonstrate isolation
- The tests that lie to you — how to avoid declaring victory too early
- Living with it: the exceptions you will actually need
- Write it down, and re-test it — the part everyone skips
- What you actually built — and what you can now say about it