// FIELD OPS

NervHQ

The network everything else on this site is proved against. It is internet-exposed on purpose: the edge takes real unsolicited scanning and credential stuffing daily, so detections here are validated against hostile traffic rather than simulated attacks.

FEATURED BUILD

NervHQ

Enterprise-grade home network & security infrastructure

A multi-host network built the way a small enterprise would be, with layered controls: segmentation across 10.6.7.0/24 for services and clients and 10.6.8.0/24 for name resolution and remote access, centralised SIEM monitoring, IDS/IPS inline at the perimeter, and encrypted remote access. It is the proving ground — every alert, tuning decision and incident writeup on my résumé originates here.

Wazuh SIEM 4.14 — manager, indexer & dashboard tiers with Filebeat shipping
pfSense perimeter with Suricata IDS/IPS inline, behind a bridged AT&T fibre modem
Pi-hole sinkhole + Unbound DNSSEC-validating recursive resolution
WireGuard remote access with per-peer keys

Network Topology 5 hosts · 2 segments · verified against the live network

                                        I N T E R N E T
                                               |
                              +----------------v---------------+
                              | AT&T Fiber modem               |
                              | bridge mode / passthrough      |
                              +----------------+---------------+
                                               |
            +==================================v==================================+
            | 10.6.7.1   pfSense              virtualised on Proxmox VE           |
            | ------------------------------------------------------------------- |
            | stateful firewall  .  allowed-traffic policy                        |
            | DHCP  .  NAT  .  routing                                            |
            | Suricata IDS/IPS inline                                             |
            |                                                                     |
            | the modem is bridged, so nothing routes around this box             |
            +==================================+==================================+
                                               |
                              +----------------v---------------+
                              | Switch                         |
                              | old router, routing off        |
                              +----------------+---------------+
                                               |
              +---------------------+----------+----------+---------------------+
              |                     |                     |                     |
    +---------v---------+ +---------v---------+ +---------v---------+ +---------v---------+
    | 10.6.7.2          | | 10.6.7.10         | | 10.6.7.24         | | 10.6.8.2          |
    | TrueNAS SCALE     | | Wazuh SIEM        | | Workstation       | | DietPi            |
    |                   | |                   | |                   | |                   |
    | ZFS storage       | | manager           | | operations        | | Pi-hole           |
    | NGINX Proxy       | | indexer           | |  and systems      | |  DNS sinkhole     |
    |  Manager          | | dashboard         | |  monitoring       | | Unbound           |
    | Docker stack      | | :443   console    | |                   | |  DNSSEC recursive |
    |  containerised    | | :55000 API        | |                   | | WireGuard         |
    |  services         | | :1514  agents     | |                   | |  remote access    |
    |                   | | :1515  enrolment  | |                   | |                   |
    +---------+---------+ +---------^---------+ +---------+---------+ +---------+---------+
              |                     |                     |                     |
              +---------------------+---------------------+---------------------+
                             agents and syslog  ---->  Wazuh SIEM

         10.6.7.0/24  services and clients          10.6.8.0/24  DNS and remote access

AT&T Fiber Modem, bridged

The fibre handoff. Put into bridge mode so it stops routing and simply passes the circuit through — every routing, DHCP and firewall decision belongs to pfSense behind it, and no traffic can take a path that skips inspection.

10.6.7.1 pfSense

The firewall everything runs through, virtualised on a Proxmox VE Type 1 hypervisor. Stateful inspection, allowed-traffic policy, DHCP and NAT, with Suricata inline as IDS/IPS so all north-south traffic crosses one inspected control point.

Switch Old router, repurposed

A retired consumer router with its routing and DHCP disabled, serving as a plain switch. It moves frames and makes no decisions; anything that looks like a policy decision happens upstream on pfSense.

10.6.7.2 TrueNAS SCALE

ZFS storage and the host for the containerised service stack, managed as declarative Docker Compose files. NGINX Proxy Manager runs here as the only internet-facing ingress, mapping public hostnames to internal endpoints with TLS terminated at the edge and certificates renewed automatically.

10.6.7.10 Wazuh SIEM

Manager, indexer and dashboard tiers. Agents and syslog from every other host land here and alerts are mapped to MITRE ATT&CK. Console on 443, API on 55000, agent listener on 1514, enrolment on 1515.

10.6.7.24 Workstation

The operations and systems-monitoring machine. Where detection rules get written, dashboards get read, and changes get made and then verified.

10.6.8.2 DietPi — DNS and VPN

A separate segment for name resolution and remote access. Pi-hole sinkholes malicious and telemetry domains and logs every query; Unbound performs DNSSEC-validating recursive resolution, so lookups are never handed to a third-party resolver. WireGuard terminates remote access with per-peer keys.

01 10.6.7.1

Perimeter pfSense + Suricata

The AT&T fibre modem is in bridge mode, so it stops routing and passes the circuit straight through. Everything after it is pfSense, virtualised on a Proxmox VE Type 1 hypervisor: stateful inspection, the allowed-traffic policy, DHCP, NAT and routing, with Suricata inline as IDS/IPS. Because the modem is bridged there is no second path — every north-south packet crosses this one box.

02 two segments

Segmentation 10.6.7.0/24 · 10.6.8.0/24

Services and clients sit on 10.6.7.0/24; name resolution and remote access are separated onto 10.6.8.0/24. Underneath, a retired consumer router with its routing and DHCP disabled acts as a plain switch — it moves frames and makes no decisions, so every policy call happens upstream on the firewall rather than in two places.

03 10.6.8.2

DNS Defence Pi-hole + Unbound

Pi-hole sinkholes malicious and telemetry domains and logs every query. Unbound behind it does DNSSEC-validating recursive resolution, so lookups resolve from the root instead of being handed to a third-party resolver that would see everything the household browses. Query logs are read for anomalous lookups and command-and-control callback patterns.

04 10.6.7.2

Compute & Storage Proxmox + TrueNAS

Proxmox VE is the Type 1 hypervisor the firewall itself runs on. TrueNAS SCALE carries the ZFS pool and the containerised stack — twelve services defined as declarative Docker Compose files managed through Dockge, with Dozzle centralising their logs. NGINX Proxy Manager runs here too, as the only internet-facing ingress, terminating TLS with certificates renewed automatically.

05 10.6.8.2

Remote Access WireGuard

WireGuard terminates on the DietPi host alongside DNS, deliberately on the segment with the least to reach. Every peer gets its own keypair with a preshared key layered over public-key authentication, and allowed-IP scoping restricts each peer to the addresses it actually needs rather than handing it the whole network.

06 10.6.7.10

Visibility Wazuh SIEM

Manager, indexer and dashboard tiers, with Filebeat shipping endpoint, file-integrity, configuration and authentication telemetry into the search cluster and alerts mapped to MITRE ATT&CK. Detection rules are hand-written, and tuned with targeted exclusions rather than broad suppression — so removing noise never quietly removes coverage.

// BUILD LOG

Build Log

SHIPPED
Red Whistle Gen 3 engineering package

Industrial design, DFM CAD, BOM, firmware with acceptance tests, companion app, and the RWP-1 relay protocol — 30 days, ~$100.
LIVE
joinredwhistle.com + the 60-second film

Ray-traced product experience, waitlist, and a published launch film scored and edited in-house.
NEXT
Red Whistle EVT prototypes & Birmingham pilot

First physical builds, FCC pre-scan groundwork, provisional patent filing, and a 1,000-unit pilot in our home city.
DEPLOYED
NervHQ — network design & segmentation

Split services and clients on 10.6.7.0/24 from name resolution and remote access on 10.6.8.0/24, with the ISP modem bridged so every packet crosses the firewall.
DEPLOYED
pfSense + Suricata perimeter

Stateful firewall, NAT policies, and inline IDS/IPS with signature-based detection and firewall log forwarding.
LIVE
Wazuh SIEM & MITRE mapping

Centralized log aggregation on the Wazuh indexer (OpenSearch) with Filebeat shipping; alerts correlated and mapped to ATT&CK tactics, rules tuned for signal.
LIVE
DNS security & encrypted access

Pi-hole sinkhole and Unbound DNSSEC-validating recursive resolution, with WireGuard remote access on the same host, per-peer keys and allowed-IP scoping.
NEXT
Automated response (SOAR)

Active-response playbooks and Suricata-triggered blocking to move from detection toward containment.
PLANNED
Detection-as-code & dashboards

Version-controlled detection rules and purpose-built Kibana dashboards for triage and threat-hunting.

NervHQ

NervHQ

Perimeter pfSense + Suricata

Segmentation 10.6.7.0/24 · 10.6.8.0/24

DNS Defence Pi-hole + Unbound

Compute & Storage Proxmox + TrueNAS

Remote Access WireGuard

Visibility Wazuh SIEM

Build Log

Red Whistle Gen 3 engineering package

joinredwhistle.com + the 60-second film

Red Whistle EVT prototypes & Birmingham pilot

NervHQ — network design & segmentation

pfSense + Suricata perimeter

Wazuh SIEM & MITRE mapping

DNS security & encrypted access

Automated response (SOAR)

Detection-as-code & dashboards