🏢 A mini datacenter

One physical server hosting multiple virtual machines — a Windows domain controller, a Linux web stack, a database, a jump box.

🌐 A segmented network

Three zones: management, DMZ, and private LAN — isolated by firewall rules on the Proxmox host itself.

📋 Proof it works

Hardware documentation, asset tracking, a Packet Tracer diagram, and a live walkthrough on demo day.

As delivered

Why this platform

• Enterprise-grade — hot-plug drives, ECC RAM, redundant PSUs — ideal for a 24/7 lab
• iLO 4 lets us install and operate without touching the physical machine
• Smart Array P420i is hardware RAID — faster and more forgiving than software RAID
• 4× 1 GbE onboard NICs give us room to segment traffic
• Two CPU sockets and 24 DIMM slots = headroom for future expansion

Compute

Memory

Storage

Networking

Power & Cooling

Firmware

Options considered

Rationale

• 3 drives = RAID 5 is the natural fit — minimum met, best space efficiency (66%)
• Survives 1 drive failure without data loss — matters with our mixed-age drive pool
• 3 TB total comfortably hosts 4 planned VMs plus ISOs + snapshots + backups
• Hardware RAID on P420i is faster than ZFS on this generation — and doesn't need HBA-mode flashing

⚠ Caveat: drives are mismatched — WD Blue (2018, consumer, no TLER) + WD RE3 (2010) + a 3rd. Operate at the slowest member's speed; the oldest drive is statistically most likely to fail first. Weekly SMART checks recommended.

What we installed with

Install ran ~5 minutes, unmounted the virtual ISO, rebooted — Proxmox came up on the first try.

What the dashboard confirmed

• ✓ Proxmox VE 8.2.2 running
• ✓ Node tctmachine online under Datacenter
• ✓ localnetwork SDN exists
• ✓ local storage mounted · 2.7% used (base system)
• ✓ local-lvm thin pool ready · 0.0% used (awaiting VMs)
• ✓ Authentication, TLS, web stack all functional

What this means

Every layer from iLO up through Proxmox UI is working. The 3 TB RAID 5 array is exposed as local (host root + ISOs) and local-lvm (VM disks). Ready to create bridges and VMs next.

Week 1 ✓ complete

• ✓ Every component identified and documented
• ✓ iLO 4 configured for remote management
• ✓ RAID 5 array built on 3× 1 TB SATA (3 TB total)
• ✓ Proxmox VE 8.2.2 installed on the array
• ✓ Management IP 10.10.10.10/16 on eno1
• ✓ Web UI live at https://10.10.10.10:8006
• ✓ Internet reachable (DNS 1.1.1.1)

Proof — screenshots captured

• POST banner with RAID 5 present + 1785 error cleared
• ORCA main menu showing the logical drive
• Proxmox installer summary
• Proxmox login / dashboard

Known follow-ups

• Rename host → pve01.capstone.local (hostnamectl)
• Run apt update && full-upgrade
• Enable no-subscription repo
• Record FBWC cache size + capacitor status
• Weekly SMART check on all 3 drives (WD RE3 is 15 yrs old)

🎯 Objective

Stand up the core services every downstream week depends on — Windows DNS/DHCP/IIS + Linux NGINX/MariaDB — on a NAT-bridged network.

The 4 phases

• Phase 0 · 🌐 verify NAT bridge + Jump Box + internet
• Phase 1 · 🪟 Windows DNS · DHCP · IIS welcome page
• Phase 2 · 🐧 Linux NGINX · MariaDB capstone_db
• Phase 3 · 🌐 cross-VM ping, nslookup, DHCP lease tests

Week 2 IP plan · 3 bridges live

VM static IPs

Correct config

auto vmbr0
iface vmbr0 inet static
    address 10.10.10.10/16
    gateway 10.10.10.1
    bridge-ports eno1
    bridge-stp off
    bridge-fd 0

auto vmbr1
iface vmbr1 inet static
    address 172.16.0.10
    netmask 255.255.255.0
    bridge-ports none
    bridge-stp off
    bridge-fd 0

auto vmbr2
iface vmbr2 inet static
    address 192.168.0.10
    netmask 255.255.255.0
    bridge-ports none
    bridge-stp off
    bridge-fd 0

After saving: ifreload -a — verify with ip addr show vmbr1 and ip addr show vmbr2.

Ping tests (from Proxmox host)

# self-tests — bridges are up?
ping -c 2 172.16.0.10       # vmbr1 self
ping -c 2 192.168.0.10      # vmbr2 self

# once VMs exist:
ping -c 4 192.168.0.2       # Win VM (vmbr2)
ping -c 4 192.168.0.3       # Linux VM (vmbr2)
ping -c 4 172.16.0.10       # DMZ Jump (vmbr1)

Outbound NAT (to internet)

Windows VM cmd:

ping 8.8.8.8
expect < 30 ms

Linux VM bash:

curl https://ifconfig.me
→ returns school public IP

If fails: confirm IP forwarding + iptables MASQUERADE on vmbr0 egress, VMs have correct gateway (192.168.0.10 for LAN, 172.16.0.10 for DMZ).

Install DNS + create zone

1. Server Manager → Add Roles → DNS Server
2. Tools → DNS → right-click Forward Lookup Zones → New Zone
3. Primary zone · name teamx.local
4. Right-click zone → New Host (A):
   name winserver · IP 192.168.0.2 · ✓ create PTR

nslookup winserver.teamx.local
Address: 192.168.0.2

Install DHCP + create scope

1. Server Manager → Add Roles → DHCP Server → complete wizard
2. Tools → DHCP → IPv4 → right-click → New Scope

Right-click scope → Activate. Test from a client: ipconfig /release && /renew.

Install + deploy

1. Server Manager → Add Roles → Web Server (IIS)
2. File Explorer → C:\inetpub\wwwroot\
3. Delete iisstart.htm + iisstart.png
4. Right-click → New → Text Document → paste HTML →
5. Save As… → type All Files → index.html

<html>
  <body>
    <h1>Welcome to Week 2!</h1>
  </body>
</html>

Test from a client

# by IP
http://192.168.0.2

# by DNS hostname
http://winserver.teamx.local

Both should render Welcome to Week 2! as an H1.

📸 Screenshot the browser showing the welcome page — URL bar must be visible.

Troubleshoot: Windows Firewall → allow HTTP (port 80) if the page can't be reached remotely.

Install & enable

sudo apt update
sudo apt install nginx -y

sudo systemctl enable nginx
sudo systemctl start nginx

sudo systemctl status nginx
● nginx.service - active (running)

Deploy the page

echo "<h1>Welcome to Linux Week 2</h1>" \
  | sudo tee /var/www/html/index.html

cat /var/www/html/index.html

Test from another VM

# from Windows or Jump Box browser
http://192.168.0.3

📸 Screenshot the browser showing the rendered heading.

If blocked: sudo ufw allow 80/tcp · verify IP is .3 · gateway .1.

Install + launch

sudo apt install mariadb-server -y
sudo systemctl enable mariadb
sudo systemctl start mariadb

# optional hardening
sudo mysql_secure_installation

sudo mysql

Create DB + user + grant

CREATE DATABASE capstone_db;

CREATE USER 'capuser'@'localhost'
  IDENTIFIED BY 'securepass';

GRANT ALL PRIVILEGES ON capstone_db.*
  TO 'capuser'@'localhost';

FLUSH PRIVILEGES;
EXIT;

Verify

mysql -u capuser -p -e "SHOW DATABASES;"
| capstone_db        |

📸 Screenshot the SHOW DATABASES; output with capstone_db visible.

Ping both directions

# Win cmd
ping 192.168.0.3

# Linux bash
ping -c 4 192.168.0.2

DNS lookup

nslookup \
  winserver.teamx.local
→ 192.168.0.2

DHCP lease

New client VM → DHCP → record the leased IP from Win DHCP Manager.

📸 5 mandatory screenshots

1. DNS zone + A record
2. DHCP scope + active lease
3. IIS page in browser
4. NGINX page in browser
5. DB CLI: SHOW DATABASES;

📄 Week 2 Report

• Cover: week, team, roles
• Phase 0 tables filled
• Test summary table w/ Pass/Fail
• 5 screenshots (above)
• Reflection ×3 (trickiest test, longest service, unresolved issues)
• Asset tracker export (VMs · IPs · roles)

Full walkthrough: week2.html

🛡 Jump Box VM — on vmbr1

• Ubuntu Server · 2 vCPU · 2 GB · 25 GB
• Static 172.16.0.x, gw 172.16.0.1
• Hardened SSH: non-root user, PermitRootLogin no
• ufw allow 22/tcp from 10.10.10.0/24, 172.16.0.0/24, 192.168.0.0/24
• DNS for all internal VMs = Windows Server IP

🔁 Reverse route — on internal VMs

# Windows (admin PowerShell)
route add 172.16.0.0 mask 255.255.255.0 192.168.0.1

# Linux
sudo ip route add 172.16.0.0/24 via 192.168.0.1

🔀 Host iptables — DNAT + persistence

# SSH port-forward: WAN :2222 → Jump Box :22
iptables -t nat -A PREROUTING -i vmbr0 \
  -p tcp --dport 2222 \
  -j DNAT --to-destination 192.168.0.2:22

iptables -A FORWARD -p tcp -d 192.168.0.0/24 \
  --dport 22 -j ACCEPT
iptables -A INPUT  -p tcp --dport 2222 -j ACCEPT

# Persist across reboots
apt install iptables-persistent
netfilter-persistent save
# or:
iptables-save > /etc/iptables/rules.v4

MASQUERADE for 172.16.0.0/24 and 192.168.0.0/24 out vmbr0 already set in /etc/network/interfaces as post-up lines.

Test: from laptop on school LAN → ssh -p 2222 [email protected] → lands on Jump Box at 192.168.0.2.

Proxmox Create VM

ISO Images storage view (Ubuntu Desktop was already there; Server downloaded next)

Ubuntu installer · Network

Profile

⚠ Ubuntu installer's autoconfig fails on vmbr1 (no DHCP) — that's expected. Set static manually.

Services depth

• Promote Windows → AD DC (capstone.local)
• Move DNS + DHCP under AD integration
• Install SQL Server Express (Windows) / confirm MariaDB connected
• Create file shares with NTFS permissions
• Ship a baseline GPO (password policy, screen lock)
• Configure Windows Backup

Harden & demo

• Tighten firewall rules: default-deny + explicit allow
• Run vulnerability scan, fix findings
• Test a real backup restore — not just "it ran"
• Break something, restore it, document the recovery
• Rehearse the demo walkthrough twice
• Sealed runbook with every password + recovery plan

Documentation

• Week 1 report form — all fields filled with real values
• Server Hardware Discovery Sheet — 12 sections, completed
• IT Asset Tracking spreadsheet — Vendors · Hardware · Software tabs
• Network diagram (Cisco Packet Tracer)
• This slide deck — presentation for demo day

Live systems

• Proxmox VE host reachable at https://10.10.10.10:8006
• iLO 4 remote management on dedicated RJ-45
• RAID 5 healthy with active parity protection
• Coming: running AD / DNS / SQL / web VMs
• Coming: firewall-enforced zone separation

Hardware

• HP POST uses different keys than Dell — F8/F9/F10/F11, not F2/F12
• E5-2609 v2 has no Hyper-Threading and no Turbo — 4 cores is the ceiling
• 1 CPU means half the DIMM slots and PCIe risers are inactive
• 4× DIMMs across 4 channels = optimal quad-channel balance for 1 CPU ✓

Process

• iLO 4 virtual media removed the need for USB installers — huge time saver
• 1785-Drive Array Not Configured is expected before RAID is built — not an error
• RAID 5 needs ≥3 drives — the controller greys it out below minimum
• Proxmox accepts single-label hostnames but FQDN pve01.capstone.local is the convention
• Drive mismatch (consumer WD Blue + 2010 WD RE3) is a reliability risk — plan to replace before production

Boot keys (HP ML350p Gen8)

Key URLs

IP plan

POST error codes

• 1785 drive array not configured → build the array
• 1779 capacitor charging → wait ~5 min
• 1794 battery < 75% capacity → replace soon
• 1797 battery failure → replace now