Project | Secure Access
Two independent remote access layers: a self-hosted Headscale mesh VPN for admin access, and a Cloudflare Tunnel in a DMZ VLAN for public-facing services. No management ports on the internet — every access path is intentional and documented.
The Cloudflare Tunnel connector LXC lives in VLAN 50, separated from the LAN. Public requests hit Cloudflare's edge, traverse the tunnel to the DMZ host, then reach internal services through the reverse proxy — no direct WAN port forwards needed.
Headscale provides a self-hosted WireGuard control plane. Admin traffic — Proxmox, OPNsense, Authentik — reaches the lab through the encrypted mesh rather than open firewall rules. Headplane gives a clean UI for managing peers and access policies.
OPNsense's ACME client issues and renews a *.masternazz.com certificate automatically via Cloudflare DNS-01. Nginx Proxy Manager terminates TLS for all subdomains, so every internal service gets HTTPS without managing individual certs.
I built two separate access layers — mesh VPN for admin, Cloudflare Tunnel for public services — because they solve different problems. I can explain why each path exists, what it protects, and where the trust boundaries are. That's the mindset network and security roles need on day one.
Project pages that cover the underlying infrastructure and monitoring.
A production-grade virtualization lab: Proxmox cluster, Cisco switching, and Synology storage.
View project ->Hardened gateway implementation: VLAN segmentation, AdGuard DNS, and Suricata IDS.
View project ->Active security monitoring and log aggregation for endpoint behavior and compliance.
View project ->Authentik implementation for SSO, OIDC, and LDAP across the lab infrastructure.
View project ->Open to Junior Network Administrator, SOC Analyst, NOC, MSP, Help Desk, IT Support, and Cybersecurity Internship opportunities.
Email: NazeemDickey@gmail.com | Boynton Beach, FL