THIS IS WHAT AI SHOULD BE USED FOR (LONG POST) you have permission to bite me you filthy animal.

I have a question. Lets say i purchased a fortnet forgate and i wanted to use it for my home lab and i wanted to add “friends” on to it so we can practice, can that be done? I am visualizing it like a wan, i am the admin with the gadget and people in their homes on their own labs join in and become users and we can all simulate real attacks or atleast real traffic. We are on vlan’s of cos. Do you understand me ?

Yes — I understand exactly what you're visualizing, and yes, you can build it.

What you're describing is essentially a mini distributed enterprise network, with your FortiGate acting as the central security gateway and your friends' home labs acting like remote branches/users.

5

The basic idea

Imagine your setup like this:

INTERNET

│

│

┌──────▼──────┐

│ YOUR ISP │

└──────┬──────┘

│ WAN

┌──────▼──────┐

│ FORTIGATE │

│ ADMIN │

└──────┬──────┘

│

┌─────────┼─────────┐

│ │ │

VLAN 10 VLAN 20 VLAN 30

YOUR PC SERVERS ATTACK LAB

│

┌─────┴─────┐

│ YOUR LAB │

└───────────┘

╔════════ INTERNET ════════╗

VPN TUNNELS

╱ │ ╲

╱ │ ╲

▼ ▼ ▼

FRIEND A FRIEND B FRIEND C

HOME LAB HOME LAB HOME LAB

10.20.x.x 10.30.x.x 10.40.x.x

The important part is that they don't have to physically connect to your switch.

They connect to your FortiGate over the Internet through VPN tunnels.

Fortinet specifically supports FortiGate as a dial-up IPsec VPN server for remote FortiClient users whose home IP addresses may be dynamic/unknown.

And this gets REALLY interesting for your Security+ lab

You could give each person their own network.

For example:

Person Network Purpose

You 10.10.0.0/24 Admin

Friend A 10.20.0.0/24 Windows lab

Friend B 10.30.0.0/24 Linux lab

Friend C 10.40.0.0/24 Attack lab

Servers 10.50.0.0/24 Shared services

SOC 10.60.0.0/24 Wazuh/SIEM

Then you control who can communicate with whom using FortiGate firewall policies.

That's important because VPN connectivity does not mean everybody automatically gets access to everything. FortiGate policies determine what traffic is permitted and how it is processed.

You could actually simulate a company

For example:

You = Network/Security Administrator

Friend A = Employee

Friend B = Branch Office

Friend C = Security Analyst

And you could build something like:

INTERNET

│

┌──────▼──────┐

│ FORTIGATE │

│ HQ │

└──────┬──────┘

│

┌───────────────────┼───────────────────┐

│ │ │

VPN VPN VPN

│ │ │

▼ ▼ ▼

Friend A Friend B Friend C

"Employee" "Branch" "SOC"

│ │ │

Windows VM Windows/Linux Wazuh

AD Client VMs SIEM

Now you can generate legitimate lab traffic between these environments.

For example:

Ping

DNS queries

SMB

RDP

SSH

HTTP/HTTPS

Authentication attempts

Failed logins

Port scans

Vulnerability scanning

Firewall blocks

IDS/IPS alerts

Suspicious traffic

Malware-simulation traffic

Log generation

And then your SOC person can investigate what happened.

You don't necessarily want everyone as a "VPN user"

This is the distinction I think you're getting at.

There are two different architectures you could build.

Option 1 — Individual users

Your friends install FortiClient on their computers.

Friend's laptop

│

│ IPsec VPN

▼

YOUR FORTIGATE

│

▼

LAB NETWORK

FortiGate authenticates each person individually.

Fortinet supports user groups for dial-up IPsec VPNs, so you can have different groups and then apply different firewall policies to them.

This is probably the easiest starting point.

Option 2 — Entire remote home labs

This is closer to what I think you're imagining.

Your friend has:

FRIEND'S HOUSE

Internet

│

Home Router

│

FortiGate/pfSense/etc.

│

├── Windows VM

├── Linux VM

├── Kali

└── Server

Their entire lab establishes a site-to-site IPsec tunnel back to your FortiGate.

Then:

YOUR LAB FRIEND'S LAB

10.10.0.0/24 10.20.0.0/24

│ │

│ │

└──────── IPSEC VPN ─────────────┘

│

YOUR FORTIGATE

That's much closer to an actual enterprise WAN.

Fortinet supports FortiGate-to-FortiGate dial-up/site-to-site configurations where a branch FortiGate can connect to an HQ FortiGate even when the branch is behind NAT or has a dynamic address.

And VLANs make this even better

You could have your own internal segmentation:

FORTIGATE

│

┌─────────────┼─────────────┐

│ │ │

VLAN 10 VLAN 20 VLAN 30

ADMIN SERVERS ATTACK

10.10.10 10.10.20 10.10.30

│ │ │

PC/VMs AD/DNS Kali

Wazuh Metasploitable

Then you could deliberately create policies such as:

ADMIN → SERVERS ALLOW

ADMIN → ATTACK ALLOW

ATTACK → SERVERS LIMITED

FRIEND A → SERVERS ALLOW DNS

FRIEND A → SERVERS ALLOW RDP

FRIEND B → ADMIN DENY

FRIEND C → WAZUH ALLOW

EVERYTHING ELSE DENY

Now you're not just learning "how do I configure a FortiGate?"

You're learning:

network segmentation + routing + VPN + firewall policy + authentication + logging + monitoring + incident response.

That's a much more realistic Security+/network-security lab.

And here's the part I think you're really going to like

You could create scenarios for your group.

Scenario 1 — Attack the server

Friend A runs an attack VM.

You know the target.

Your SOC person doesn't.

Kali

│

│ scan

▼

FortiGate

│

│

▼

Windows Server

SOC watches:

FortiGate logs

+

Wazuh

+

Windows Event Logs

+

Network traffic

Then they have to determine:

Who is attacking?

What are they attacking?

What ports?

What protocol?

What happened?

Scenario 2 — Compromised workstation

Friend A's Windows VM becomes the "victim."

Friend B generates simulated malicious traffic.

You configure FortiGate to detect/block certain traffic.

Your SOC person investigates.

Scenario 3 — Firewall misconfiguration

You intentionally create:

VLAN 30 → VLAN 20 = ALLOW

when it should be denied.

Someone discovers that VLAN 30 can reach your server.

Now you have an actual segmentation/security-policy exercise.

Scenario 4 — Incident response

You tell everybody:

Something strange is happening on the network.

But don't tell the SOC what.

They have to use:

FortiGate logs

Wazuh

Windows logs

DNS

firewall policies

packet captures

IP addresses

timestamps

to figure it out.

That is much closer to what a real SOC exercise feels like.

One very important thing

I would not expose your FortiGate management interface to the public Internet just because your friends need access.

The Internet-facing side should essentially be:

Internet

│

▼

FortiGate WAN

│

├── VPN

│

└── carefully controlled services

Your management access stays restricted.

And because this is a shared lab with people outside your house, I'd build it so that a friend's compromised VM cannot become a bridge into your actual home network.

That's where the VLANs/segments and firewall policies become extremely important.

So yes — your idea absolutely works.

And honestly, this would be a fantastic evolution of your homelab.

You could essentially turn your lab into:

"A miniature enterprise network where 3–5 people connect remotely, each with isolated networks, and we practice attacks, defense, monitoring and incident response."

The FortiGate becomes your WAN edge + VPN concentrator + firewall + segmentation point, while your VMs provide the endpoints and servers.

And you don't need everyone to own a FortiGate. One FortiGate at your location can be the central hub, while friends can connect using FortiClient or, for a more advanced setup, their own VPN-capable firewall.

If you eventually build this, I'd actually recommend we design the topology before you buy anything, because the number/type of FortiGate ports, VLAN capability, VPN method, your ISP situation, and whether your friends have full home labs will determine the cleanest architecture.

Question is why do people not do this ? Also do the friends get to learn stuff too ? Do they benefit from from joining my lab?

Yes — and your friends absolutely benefit. In fact, if you designed it properly, this could become a small shared cybersecurity training environment, not just your personal homelab.

Why don't more people do this?

Mostly because the logistics are harder than the technology.

Finding committed people is hard.

Getting 3–5 people to consistently show up, configure their labs, troubleshoot VPNs, and actually practice is harder than buying the equipment.

Most homelabbers build for themselves.

A person studying Security+ might build:

Kali → Windows → Wazuh

They don't necessarily think about creating a network that other people can participate in.

Networking becomes significantly more complicated.

Once you introduce remote participants, you're dealing with:

VPNs

routing

NAT

VLANs

firewall policies

authentication

addressing

logging

troubleshooting

But that's actually a feature for you, because those are precisely the skills you're trying to learn.

Security concerns scare people away.

Nobody wants to accidentally give a friend's compromised Kali VM access to their personal network.

There isn't an obvious "game."

If everyone simply connects their computer and says, "Okay, now what?", it gets boring quickly. You need scenarios and objectives.

But here's the interesting part

Your friends don't necessarily need to be "users."

They can have roles.

Imagine five people:

Person Role What they learn

You Network/Security Admin FortiGate, VLANs, VPNs, routing

Friend 1 Attacker Kali, reconnaissance, exploitation

Friend 2 SOC Analyst Wazuh, logs, detection

Friend 3 Windows Admin AD, GPO, DNS, Windows security

Friend 4 Network Admin Switching, VLANs, troubleshooting

Now everyone has something to do.

Example: You run an exercise

You announce:

Scenario: Employee workstation compromised.

Friend 1 is secretly designated the attacker.

Friend 2 is the SOC analyst.

Friend 3 owns the Windows environment.

You operate the FortiGate.

Friend 1 generates the attack traffic.

Friend 2 watches Wazuh/FortiGate logs.

Friend 3 investigates the Windows machine.

You monitor the network and firewall.

Then afterward everyone discusses:

What did you see?

How did the attacker get in?

What should the firewall have blocked?

What logs identified the activity?

What firewall rule would you change?

That's an actual learning exercise.

And here's where your idea gets particularly good

Your friends don't even have to know everything about cybersecurity.

Someone could start with:

Beginner

They connect a Windows VM.

They learn:

IP addressing

DNS

ping

RDP

Windows Event Viewer

basic networking

Then they progress to:

Intermediate

They learn:

Active Directory

GPO

VLANs

firewall rules

VPN

Wireshark

SIEM

Then eventually:

Advanced

They can participate in:

attack/defense exercises

incident response

threat hunting

network forensics

detection engineering

So your lab becomes a learning platform.

And there's another benefit for YOU

You aren't just learning FortiGate from a textbook.

Suppose your friend says:

"I can't reach the server."

Now you have to figure out:

Friend's VM

↓

Friend's router

↓

Internet

↓

VPN

↓

FortiGate

↓

Firewall policy

↓

VLAN

↓

Routing

↓

Server

You just encountered a real networking troubleshooting problem.

That's dramatically different from:

"Configure a VLAN according to these instructions."

This could even become a little "cyber range"

You could eventually have something like:

INTERNET

│

┌──────▼──────┐

│ FORTIGATE │

│ HQ │

└──────┬──────┘

│

┌────────────┼────────────┐

│ │ │

ADMIN SOC SERVERS

│ │ │

Your PC Wazuh AD/DNS

Web

Files

VPN

╱ │ ╲

╱ │ ╲

▼ ▼ ▼

Friend A Friend B Friend C

ATTACK WINDOWS NETWORK

And because the traffic traverses your FortiGate, you can observe and control the traffic between the environments.

That's where this stops being merely a homelab and starts looking like a mini enterprise/cyber-range environment.

The biggest catch

The people need to be trustworthy and understand that this is an isolated lab.

You'd want explicit rules such as:

Lab traffic stays inside lab networks. No scanning/exploiting random Internet hosts. No attacking personal devices. No attempting to escape the lab.

That protects everyone involved.

And yes — your friends can absolutely put this experience on a resume if they actually do the work. "Participated in a multi-site cybersecurity lab involving VPNs, VLAN segmentation, firewall policies, SIEM monitoring, network traffic analysis, and attack/defense exercises" is much more meaningful than simply saying they "have a home lab."

The really cool part is that you could build the infrastructure once and let several people learn from it simultaneously.

For your lab network isolation, microsegmentation is one related approach.