All CDW VMs are hosted on PVE2 (192.168.1.9) on bridge vmbr50 (VLAN 50, 192.168.50.0/24).
| VMID |
Name |
IP |
OS |
CPU |
RAM |
Disk |
Role |
Status |
| 300 |
crc-guac-gateway-02 |
192.168.50.10 |
Ubuntu 22.04 |
4 |
8 GB |
80 GB |
Apache Guacamole (access gateway) |
Running |
| 301 |
crc-cdw-vpn-01 |
192.168.50.11 |
Ubuntu 22.04 |
2 |
4 GB |
40 GB |
WireGuard VPN gateway |
Running |
| 302 |
crc-cdw-ops-01 |
192.168.50.12 |
Kali Linux 2026.1 |
6 |
16 GB |
150 GB |
Ops workstation (pentesting) |
Running |
| 303 |
crc-cdw-scan-01 |
192.168.50.13 |
Ubuntu 22.04 |
4 |
8 GB |
80 GB |
OpenVAS vulnerability scanner |
Running |
| 304 |
crc-cdw-monitor-01 |
192.168.50.14 |
Ubuntu 22.04 |
4 |
8 GB |
100 GB |
Wazuh SIEM/monitoring |
Running |
| 305 |
crc-cdw-win-01 |
192.168.50.15 |
Windows Server 2022 |
4 |
8 GB |
100 GB |
Windows tools (RSAT, Sysinternals) |
Pending OS Install |
| 306 |
crc-cdw-capture-01 |
192.168.50.16 |
Ubuntu 22.04 |
2 |
4 GB |
40 GB |
Packet capture (tcpdump/tshark) |
Running |
- Role: WireGuard VPN gateway for client tunnel access
- VPN Interface: wg0
- VPN Subnet: 10.50.10.0/24
- Listen Port: 51820/UDP
- Server Public Key:
D3TUkyiq/jiY62vNqotmEXQjzju4sjCk5bA7dSueNxw=
- Forwarding: Enabled (net.ipv4.ip_forward=1)
- NAT: iptables MASQUERADE on wg0 ↔ eth0
- Role: Primary pentesting / operations workstation
- OS: Kali GNU/Linux 2026.1 (native cloud image)
- Desktop: XFCE4
- Remote Access: XRDP on port 3389 (via Guacamole)
- Installed Tools:
- nmap, nikto, hydra, john, hashcat, sqlmap
- Metasploit Framework
- NetExec (CrackMapExec replacement), Impacket, Responder
- BloodHound, enum4linux-ng, gobuster
- Wireshark/tshark
- VPN Route: 10.50.10.0/24 via 192.168.50.11
- Role: Vulnerability scanning
- Scanner: Greenbone OpenVAS (Docker container)
- Web UI: https://192.168.50.13:9392
- Default Login: admin / CDW_Scanner_2026!
- Role: SIEM, log monitoring, security dashboards
- Stack: Wazuh single-node Docker (indexer + manager + dashboard)
- Web UI: https://192.168.50.14 (Wazuh dashboard)
- Default Login: admin / SecretPassword
- Containers: wazuh-indexer, wazuh-manager, wazuh-dashboard
- Role: Windows tools workstation
- Status: PENDING — requires manual OS install via Proxmox console
- Planned Tools: RSAT, Sysinternals, PowerShell modules
- Config: UEFI boot, TPM enabled, 4 CPU / 8 GB RAM / 100 GB disk
- Role: Network packet capture and analysis
- Tools: tcpdump, tshark (Wireshark CLI)
All VMs have a baseline snapshot:
- Snapshot Name:
cdw-baseline-v1
- Contains: Clean systems with tools installed, no engagement data
# SSH to PVE2
ssh devin-adm@192.168.1.9
# Rollback (stops VM, restores, starts)
sudo qm rollback <VMID> cdw-baseline-v1
sudo qm start <VMID>
for vmid in 300 301 302 303 304 306; do
sudo qm rollback $vmid cdw-baseline-v1
sudo qm start $vmid
echo "VM $vmid reset"
done