The home lab leveled up today. After getting Proxmox VE 9.2 running inside VMware last session, today’s mission was clear — get an attacker and a target on the same isolated network and prepare for real penetration testing practice.
Here’s what I built.
The Setup
Proxmox is running as a nested VM inside VMware Workstation on my Debian host. Inside Proxmox I have two VMs on an isolated internal network called vmbr1 — no internet access, no gateway, completely air-gapped from my real network. That isolation is the whole point. Metasploitable2 is a deliberately vulnerable Linux machine. Kali is the attacker. Neither touches anything outside the lab.
Metasploitable2 — The Target
Already imported from last session. Booted it up, logged in as msfadmin, and assigned a static IP manually since vmbr1 has no DHCP:
bash
sudo ifconfig eth0 192.168.100.2 netmask 255.255.255.0 upTarget is live at 192.168.100.2.
Kali Linux 2026.2 — The Attacker
Rather than import my existing 100GB Kali VMDK (too large for the Proxmox VM’s 40GB disk), I downloaded the Kali 2026.2 installer ISO directly onto Proxmox and did a fresh install. Clean, lean, purpose-built for this lab. Assigned static IP 192.168.100.3 during installation.
The cyber range is almost complete. Next session: verify connectivity, run the first nmap scan, and start working through Metasploitable2 with Metasploit Framework.
The Lab at a Glance:
| VM | Role | IP | Network |
|---|---|---|---|
| Metasploitable2 | Target | 192.168.100.2 | vmbr1 (isolated) |
| Kali Linux 2026.2 | Attacker | 192.168.100.3 | vmbr1 (isolated) |
Default Metasploitable2 credentials: msfadmin/msfadmin. Never expose this VM to an untrusted network.