Chapter 62 — Capstone lab: build, break, observe, and repair a production-like network
Goal
Build a small lab that contains the pieces you will meet in real work: clients, DNS, a load balancer, two app servers, a database subnet, firewall rules, TLS, monitoring, and packet capture.
Minimum topology
client subnet
|
firewall/router
|
load balancer
/ \
app1 app2
|
database subnet
You can implement this with VMs, Linux network namespaces, Docker/Podman, or cloud free-tier resources. The value is not the tool; the value is watching traffic cross each boundary.
Required exercises
- Draw the diagram before building.
- Assign subnets and document them.
- Make DNS names for the load balancer and database.
- Terminate TLS at the load balancer.
- Add health checks and take one app down.
- Capture a successful request at client, load balancer, and app.
- Break DNS and diagnose it.
- Break the firewall and distinguish drop vs reject.
- Break MTU with a tunnel or lowered interface MTU.
- Fill the uplink and observe latency under load.
- Rotate a certificate.
- Write a one-page incident report for one failure.
Passing standard
You are done when you can answer, from evidence:
- Where did the packet stop?
- Which layer failed?
- Which command proved it?
- What fixed it?
- What would have alerted earlier?
- What rollback would have restored service fastest?
This capstone turns the guide from reading into operational muscle memory.
The Go variant: build the lab from your own tools
If you've done the "Build it in Go" sections, you can build most of this capstone from programs you wrote, which means you understand every moving part:
| Lab component | Your Go program | Chapter |
|---|---|---|
| Load balancer with health checks and draining | lbdrain lb + lbdrain backend ×2 |
57 |
| TLS termination with hot certificate rotation | wrap lbdrain lb in certreload's GetCertificate |
56 |
| Client IP preservation through an L4 hop | proxyproto in front of the backends |
57 |
| Firewall verification from each subnet | policytest with one policy file per subnet |
53 |
| Synthetic monitoring and latency histograms | prober scraped by Prometheus |
46–47 |
| "Which layer is broken?" in one command | netcheck |
34 |
| DNS consistency across resolvers | dnsdiff |
55 |
| Packet evidence | tcpdump -w, then pcapread |
31–32 |
Put each component in its own network namespace (Chapter 52) or container, connect them with a bridge, apply the nftables policy from Chapter 53 to the "firewall" namespace, and run the twelve required exercises. The Go plan's capstone, a cloud-edge security proxy (Week 17), is the production-grade version of the same idea, with a WAF, rate limiting, and DDoS defences in front.