Build your own virtualization lab with VMware ESXi 7.0

Introduction

VMware ESXi 7.0 is a Type-1 (bare-metal) hypervisor that allows you to run multiple virtual machines on a single physical server. Whether you're building a home lab, preparing for VMware certification, or deploying virtualization in production, ESXi remains one of the industry's leading hypervisors.

In this guide, we'll walk through the complete installation process—from downloading the installer to accessing the ESXi web interface.

Prerequisites

Before starting, make sure you have the following:

Hardware Requirements

Tip: ESXi 7.0 works best when installed on SSD or NVMe storage. VMware recommends avoiding low-end USB or SD card boot devices for new installations because of increased write activity in ESXi 7.0.

What You'll Need

• VMware ESXi 7.0 ISO
• USB Flash Drive (8GB or larger)
• Rufus (Windows) or Balena Etcher
• Physical Server or Compatible PC
• Keyboard and Monitor (or iLO/iDRAC/IPMI)

Step 1 – Download VMware ESXi 7.0

Download the ESXi 7.0 ISO from the Broadcom Support Portal.

Make sure you download the version that matches your hardware vendor if available (Dell, HPE, Lenovo, Cisco, etc.).

Vendor-customized ISOs include optimized drivers for your hardware.

Step 2 – Create a Bootable USB

Using Rufus:

1. Insert your USB drive.
2. Open Rufus.
3. Select the ESXi ISO.
4. Partition Scheme:
   • MBR (Legacy BIOS)
   • GPT (UEFI)
5. Click Start.

After completion, safely eject the USB.

Step 3 – Configure BIOS

Enter the server BIOS.

Enable:

• Intel VT-x or AMD-V
• Intel VT-d (optional)
• UEFI Boot (recommended)
• Disable Secure Boot if unsupported

Set the USB drive as the first boot device.

Save and reboot.

Step 4 – Boot the ESXi Installer

After booting from USB, you'll see:

Loading VMware ESXi Installer...

Wait a few moments.

The installer will initialize the hardware.

Step 5 – Start Installation

When prompted:

Welcome to VMware ESXi 7.0 Installer

Press

ENTER

to continue.

Step 6 – Accept the License Agreement

Read the EULA.

Press

F11

to accept.

Step 7 – Select Installation Disk

The installer detects available storage devices.

Example:

Samsung SSD 870 EVO
120 GB

Kingston NVMe
500 GB

Choose the drive where ESXi will be installed.

Press:

ENTER

Step 8 – Select Keyboard Layout

Usually:

US Default

Press Enter.

Step 9 – Create the Root Password

Create a strong password.

Example:

Username:
root

Password:
************

Requirements:

• 8+ characters
• Uppercase
• Lowercase
• Number
• Symbol

Press Enter.

Step 10 – Confirm Installation

The installer warns that the selected disk will be erased.

Press:

F11

Installation begins.

Usually takes:

5–10 minutes.

Step 11 – Reboot

When installation completes:

Installation Complete

Remove Installation Media

Press ENTER to Reboot

Remove the USB installer.

Press Enter.

Step 12 – First Boot

ESXi loads.

Eventually you'll reach the Direct Console User Interface (DCUI).

Example:

VMware ESXi 7.0

Press F2 to Customize

You'll also see a DHCP-assigned IP address if one is available.

Step 13 – Configure the Management Network

Press:

F2

Login:

Username:
root

Password:
********

Navigate to:

Configure Management Network

Configure Network Adapter

Select:

Network Adapters

Choose the physical NIC connected to your network.

Configure IPv4

Navigate:

IPv4 Configuration

Select:

Static IPv4

Example:

IP:
192.168.0.20

Subnet:
255.255.255.0

Gateway:
192.168.0.1

Configure DNS

Primary DNS:
8.8.8.8

Secondary DNS:
1.1.1.1

Hostname:
esxi01

Restart Management Network

Press:

ESC

Choose:

Yes

The Management Network restarts.

Step 14 – Access the Web Interface

From another computer, open:

https://192.168.0.20

Ignore the SSL warning.

Login:

Username:
root

Password:
********

You'll now access the ESXi Host Client.

Step 15 – Create a Datastore

Navigate:

Storage

If a datastore wasn't created automatically:

New Datastore

Choose:

• VMFS 6
• Entire Disk

Finish.

Step 16 – Configure Licensing

Navigate:

Host

Manage

Licensing

Choose:

Assign License

Enter your VMware license key.

If you don't have one, ESXi runs in Evaluation Mode for 60 days.

Step 17 – Upload ISO Files

Navigate:

Storage

Datastore Browser

Create folders:

ISO

Templates

VMs

Upload:

• Windows ISO
• Ubuntu ISO
• Rocky Linux
• VMware Tools

Step 18 – Create Your First Virtual Machine

Click:

Virtual Machines

Create/Register VM

Select:

Create New VM

Example:

Name:
Ubuntu01

Guest OS:
Ubuntu Linux 64-bit

CPU:
2

Memory:
4096 MB

Disk:
40 GB

Attach the ISO.

Power it on.

Recommended Post-Installation Tasks

• Configure NTP
• Enable SSH (only when needed)
• Configure DNS
• Configure Hostname
• Create VM Network Port Groups
• Configure VLANs
• Set Power Policy to High Performance
• Configure Local Users and Roles
• Enable Lockdown Mode (production)
• Configure Backups
• Install VMware Tools on guest VMs
• Monitor host health

Troubleshooting

No Compatible Network Adapter Found

Cause:
Unsupported NIC.

Solution:

• Verify your hardware against the VMware Compatibility Guide.
• Use a vendor-customized ESXi ISO with the appropriate network drivers.

No Storage Devices Found

Possible causes:

• RAID controller not configured
• Unsupported storage controller
• NVMe driver issue

Check BIOS and RAID settings before reinstalling.

Cannot Access Web UI

Verify:

• Static IP
• Gateway
• DNS
• Network cable
• Firewall
• HTTPS (port 443)

Test connectivity:

ping 192.168.0.20

Purple Screen of Death (PSOD)

Common causes:

• Unsupported CPU
• Faulty RAM
• Driver incompatibility
• Hardware failure

Check server logs and firmware versions.

Best Practices

• Use SSD or NVMe for the ESXi boot device.
• Keep firmware and drivers updated.
• Use static IP addresses for management.
• Back up the ESXi host configuration regularly.
• Install vendor-customized ESXi images when available.
• Use NTP to keep host time synchronized.
• Store ISO files on a dedicated datastore.
• Avoid enabling SSH permanently in production.

Conclusion

Installing VMware ESXi 7.0 is a straightforward process that provides a powerful foundation for virtualization. After installation, you can begin deploying virtual machines, configuring networking and storage, and building a home lab or production environment.

Whether you're preparing for VMware certification, building a personal lab, or deploying enterprise infrastructure, mastering ESXi installation is the first step toward becoming proficient with VMware vSphere.

Discover how Proxmox Datacenter Manager (PDM) provides a centralized dashboard, unified monitoring, VM migration, and simplified management across all your Proxmox clusters from a single interface.

As virtualization environments continue to grow, managing multiple hypervisors and clusters becomes increasingly complex. While Proxmox VE has always been an excellent open-source virtualization platform, administrators have often needed to switch between multiple web interfaces to manage different clusters.

This is where Proxmox Data Center Manager (PDM) comes in.

What is Proxmox Data Center Manager?

Proxmox Data Center Manager (PDM) is a centralized management platform designed to manage multiple Proxmox Virtual Environment (PVE) clusters from a single interface.

Instead of logging into each individual Proxmox cluster, administrators can register multiple clusters into PDM and gain a unified view of their entire virtualization infrastructure.

Think of it as a single pane of glass for your Proxmox environment.

Why Do We Need PDM?

Many organizations eventually reach a point where one cluster is no longer enough.

You might have:

• Production Cluster
• Development Cluster
• Disaster Recovery Cluster
• Edge Clusters
• Branch Office Clusters
• Lab Environment

Without centralized management, administrators constantly switch between web interfaces, making monitoring and administration more difficult.

PDM simplifies this by bringing everything together.

Key Features

Centralized Dashboard

Monitor all registered Proxmox clusters from one dashboard.

You can quickly view:

• Cluster health
• CPU utilization
• Memory usage
• Storage capacity
• Node status
• Virtual machines
• Containers

No more opening multiple browser tabs.

Multi-Cluster Management

PDM allows administrators to register multiple independent Proxmox clusters.

Example:

Everything becomes accessible from one portal.

Unified Inventory

Quickly locate resources across all clusters.

Search for:

• Virtual Machines
• Containers
• Storage
• Nodes
• Networks

Instead of remembering which cluster hosts a particular VM, simply search for it.

Role-Based Access Control (RBAC)

PDM integrates with the existing Proxmox permission model.

You can assign users different roles, such as:

• Infrastructure Administrators
• Virtualization Team
• Network Team
• Backup Team
• Read-Only Auditors

This improves security while maintaining operational flexibility.

Monitoring and Alerts

PDM provides visibility into infrastructure health.

Examples include:

• Offline nodes
• High CPU usage
• Storage nearing capacity
• Memory exhaustion
• Cluster warnings

This enables administrators to identify issues before they affect production workloads.

Typical Architecture

PDM acts as the management layer while each Proxmox cluster continues to operate independently.

Things to Keep in Mind

While PDM simplifies management, it does not replace Proxmox VE. Your clusters remain independent, and workloads continue to run on their respective nodes. PDM serves as the centralized management and visibility layer.

For organizations with a single small cluster, PDM may not provide significant advantages. However, as your infrastructure grows, centralized management becomes increasingly valuable.

Final Thoughts

Proxmox Data Center Manager represents an important step forward for organizations adopting Proxmox at scale. By providing centralized visibility, simplified administration, and multi-cluster management, it reduces operational complexity while improving efficiency.

Whether you're running a home lab with multiple clusters or managing enterprise virtualization across several data centers, PDM offers a modern approach to infrastructure management that aligns with the needs of today's distributed environments.

As Proxmox continues to evolve, tools like PDM make it easier for IT teams to scale confidently without sacrificing simplicity.

Reduce Downtime, Improve Business Continuity, and Lower Virtualization Costs Without Compromising Enterprise Features

In today's digital landscape, businesses rely heavily on IT infrastructure to support daily operations, customer services, and business growth. Whether you're running a manufacturing company, retail business, professional services firm, or managed service provider, downtime can directly impact productivity, customer satisfaction, and revenue.

For many business owners, the challenge is finding a virtualization platform that delivers enterprise-grade reliability without the high licensing costs often associated with traditional solutions.

This is where Proxmox VE 9.2.2 stands out.

With built-in features such as High Availability (HA), Network Bonding, Storage Replication, and Node Affinity, Proxmox enables organizations to build resilient, scalable, and cost-effective infrastructure using standard hardware.

What is Proxmox VE 9.2.2?

Proxmox Virtual Environment (PVE) is an open-source enterprise virtualization platform that combines:

• KVM Virtual Machines
• Linux Containers (LXC)
• Clustering
• Software Defined Storage
• Backup and Recovery
• High Availability
• Centralized Management

Unlike many commercial virtualization platforms, Proxmox provides enterprise capabilities without per-core or per-socket licensing costs.

For growing businesses, this means more budget can be invested in innovation, cybersecurity, and infrastructure improvements rather than software licensing.

High Availability: Keeping Your Business Running

Imagine your primary server suddenly fails during business hours.

Without High Availability:

❌ Critical applications go offline

❌ Employees cannot access systems

❌ Customers may experience service interruptions

❌ Revenue and productivity are impacted

With Proxmox High Availability, workloads are automatically restarted on another available node within the cluster.

Real-World Example

A business operates:

• ERP System
• File Server
• Active Directory
• Accounting Application
• Internal Web Applications

across a three-node Proxmox cluster.

If one physical server experiences hardware failure:

1. Proxmox detects the failure
2. HA Manager initiates recovery
3. Virtual machines restart on another node
4. Business operations continue with minimal disruption

Business Benefits

✔ Reduced downtime

✔ Improved business continuity

✔ Automated failover

✔ Increased customer confidence

✔ Reduced dependency on manual intervention

For small and medium-sized businesses, this provides enterprise-level protection without requiring a dedicated enterprise budget.

Network Bonding: Eliminating Single Points of Failure

Many organizations invest heavily in servers but overlook one critical component: network redundancy.

A failed network cable or switch port can cause service interruptions even when servers remain operational.

Proxmox supports Network Bonding, allowing multiple physical network interfaces to function as a single logical connection.

Advantages

Redundancy

If one network interface fails, traffic automatically continues through the remaining connection.

Increased Performance

Using LACP (802.3ad), organizations can aggregate multiple interfaces for higher throughput.

Better Cluster Reliability

Cluster communication remains stable even during network failures.

Improved Storage Replication

Dedicated bonded links can be used for:

• Replication traffic
• Backup traffic
• Cluster synchronization

The result is a more resilient infrastructure capable of supporting mission-critical workloads.

Storage Replication: Built-In Disaster Recovery

Disaster recovery is often perceived as expensive and complex.

Proxmox changes this by including Storage Replication directly within the platform.

When using ZFS storage, virtual machine data can be replicated automatically between nodes at scheduled intervals.

Only changed blocks are transferred, making replication efficient and bandwidth-friendly.

Business Benefits

✔ Faster recovery during hardware failures

✔ Improved disaster preparedness

✔ Reduced recovery time objectives (RTO)

✔ No need for expensive SAN solutions

✔ Lower infrastructure costs

For businesses that cannot justify enterprise storage arrays, Proxmox provides a practical and affordable alternative.

Node Affinity: Putting Workloads Where They Belong

Not all workloads have the same requirements.

A database server may require:

• Faster CPUs
• More RAM
• NVMe storage

while a file server may operate efficiently on standard infrastructure.

Node Affinity allows administrators to define preferred locations for specific workloads.

Example Use Cases

Database Workloads

Prioritize nodes with:

• High-performance NVMe storage
• Larger memory capacity
• Higher CPU resources

Business-Critical Applications

Ensure important systems run on preferred hardware.

Compliance Requirements

Keep regulated workloads on designated infrastructure.

Performance Optimization

Distribute workloads strategically across the cluster.

Node Affinity provides greater control over infrastructure resources while maintaining the flexibility of virtualization.

A Practical SMB Deployment Scenario

Consider a growing business with:

Infrastructure

What Happens During a Failure?

If Node 1 experiences hardware failure:

• Replicated data already exists on Node 2
• High Availability detects the outage
• Protected workloads restart automatically
• Business services remain available

Instead of experiencing hours of downtime, recovery occurs automatically within minutes.

Why Proxmox is a Good Alternative

Business owners increasingly expect IT investments to deliver measurable business value.

Proxmox helps achieve this through:

Lower Total Cost of Ownership

No expensive per-core licensing fees.

Improved Business Continuity

Built-in High Availability and Replication reduce operational risk.

Scalability

Grow from a small cluster to enterprise-scale environments without redesigning infrastructure.

Vendor Independence

Choose the hardware, storage, and networking vendors that best fit your business needs.

Investment Protection

Avoid vendor lock-in while maintaining enterprise functionality.

For organizations seeking long-term flexibility and cost control, this is a compelling advantage.

Final Thoughts

Proxmox VE 9.2.2 has evolved into a mature enterprise virtualization platform capable of supporting production workloads across a wide range of industries.

Its combination of:

• High Availability
• Network Bonding
• Storage Replication
• Node Affinity
• Live Migration
• Enterprise Clustering

allows organizations to build resilient infrastructure without the burden of excessive licensing costs.

For business owners, the benefits are clear:

Less downtime. Lower costs. Greater flexibility. Better business continuity.

Whether you're modernizing existing infrastructure, planning a virtualization refresh, or evaluating alternatives to traditional platforms, Proxmox VE 9.2.2 deserves a place on your shortlist.

There was a time when scaling meant adding more VMs.

Traffic goes up? Add a server. CPU spikes? Resize the instance.

It worked… for a while.

But eventually, it didn’t.

More servers just meant more management. More maintenance. More complexity.

And even with extra capacity, the same issues kept coming back.

That’s when I realized something important.

The problem wasn’t capacity.

It was architecture.

So instead of adding more machines, I changed the approach.

I used the Azure Kubernetes Service — not just to use Kubernetes, but to build a system that can adapt on its own.

🔄 The Shift: From Servers to Workloads

Before AKS, my mindset was tied to infrastructure:

• Which VM is overloaded?
• Do I need a bigger instance?
• Should I spin up another server?

After AKS, the questions changed:

• Is my application healthy?
• Are my pods scaling properly?
• Is traffic distributed efficiently?

That shift alone changes how you design systems.

Because Kubernetes doesn’t care about your servers.

It cares about desired state.

🧠 What AKS Really Solves

With AKS, I stopped dealing with:

• Manual scaling
• Load balancing configurations
• Node lifecycle management

Azure handles all of that.

Instead, I define:

• How much CPU a workload needs
• When it should scale
• How many instances should exist

And the platform takes care of the rest.

🛠️ The Build (Simple but Powerful)

I kept the setup intentionally simple:

• 1 AKS cluster
• 1 node pool (autoscaling enabled)
• 1 containerized app (vtoxzy/webme)
• 1 public LoadBalancer

Create AKS Cluster

Using Azure GUI

Using Cloud Shell CLI

Start small. Let it grow when needed.

Connect to AKS

Managing AKS

Here are the primary commands I use to check status:

kubectl get nodes — to check the number of nodes and their status

kubectl get pods — to check pod status

kubectl get svc — to check running service

Deploy Application

In Cloud Shell, create a YAML file.

1. nano webme.yml

Deploy the application.

1. kubectl apply -f webme.yaml

Verify the pods.

1. kubectl get pods

Check the public IP in the web browser.

Add 10 pods.

1. kubectl scale deployment webme-development --replicas=10

⚡ Where It Gets Interesting: Autoscaling

This is where AKS actually changes the game.

I enabled Horizontal Pod Autoscaler (HPA):

kubectl autoscale deployment webme \
--cpu-percent=50 \
--min=1 \
--max=5

Now the system behaves differently:

• CPU increases → more pods spin up
• CPU drops → pods scale down

No manual action.

No guessing.

💡 The Things That Will Break It

Kubernetes is powerful — but it’s not magic.

If you don’t define things properly, nothing happens.

Here are the common mistakes:

• ❌ No CPU requests → HPA won’t trigger
• ❌ Autoscaler disabled → nodes won’t scale
• ❌ Pods still fit in existing nodes → no scale-out

The system follows rules. You just need to set them right.

🧱 What Actually Changed

Before:

• Reactive operations
• Manual scaling
• Constant monitoring

After:

• Automated scaling
• Self-healing workloads
• Predictable behavior under load

And most importantly—

Less time fixing infrastructure.
More time improving systems.

🎯 Final Thought

A lot of teams think scaling means adding more servers.

But that’s just adding weight to the same problem.

Real scalability comes from systems that adjust themselves.

That’s what Azure Kubernetes Service gives you.

Not just more capacity.

But control over behavior.

🏁 TL;DR

• Stop thinking in VMs
• Start thinking in workloads
• Enable autoscaling early
• Define CPU requests properly
• Let the platform do its job

If your infrastructure still depends on manual scaling…

You’re not scaling.

You’re surviving.

There’s a moment every infrastructure engineer knows—the one where everything is fine… until it isn’t.

For me, it happened at 2AM. CPU utilization shot up to 100%, alerts started firing non-stop, and users were quietly dropping off. I was inside Microsoft Azure, manually resizing virtual machines, trying to keep the system alive. It worked—but barely. And more importantly, it wasn’t sustainable.

That night made one thing very clear:
The problem wasn’t capacity. It was control.

🔴 The Problem: Reactive Infrastructure

Like many setups, I was running on fixed resources. During normal hours, everything was stable. But when demand spiked, the system had no way to adapt on its own.

That meant:

• Either overprovision (and waste money), or
• Underprovision (and risk downtime)

And when traffic surged, it always came down to one thing:
How fast I could react.

That’s not how modern infrastructure should work.

⚙️ The Architecture: Simple, Scalable, and Smart

Instead of adding complexity, I simplified the design and focused on automation.

Here’s the actual architecture I implemented:

Azure Autoscale Architecture

🧱 Core Components

• Region: East US 2
• Virtual Network: 10.0.1.0/24
• NSG: Secured inbound/outbound traffic
• Availability Zone: Single zone (can expand to multi-zone)
• Compute: Virtual Machine Scale Set (VMSS)

⚙️ The Shift: Letting the System Think

Instead of fighting the spikes, I redesigned the approach.

I implemented Azure Autoscale using a Virtual Machine Scale Set. The idea was simple:

• Minimum instances: 1
• Maximum instances: 3
• Scale out if CPU > 80%
• Scale in if CPU < 30%

No complex logic. Just clear thresholds based on real behavior.

To validate it, I simulated load using a simple Linux stress tool. As CPU usage climbed, I watched new instances spin up automatically. When the load dropped, the system scaled back down quietly.

No clicks. No panic.
Just automation doing exactly what it was designed to do.

💡 The Outcome: Stability Without Stress

That one change had an immediate impact.

Performance became consistent—even under heavy load. Users no longer felt slowdowns. And instead of guessing how much capacity I needed, the system adjusted itself in real time.

But the biggest win wasn’t technical.

It was operational.

• No more late-night firefighting
• No more overpaying for idle resources
• No more reactive decision-making

For the first time, the infrastructure felt… effortless.

🚀 Why Autoscale Matters

Autoscale isn’t just about adding more servers—it’s about building systems that respond intelligently to demand.

Here’s what it unlocks:

Cost Efficiency
You only pay for what you actually use.

High Availability
The system reacts faster than any human ever could.

Performance Stability
Traffic spikes are absorbed seamlessly.

Operational Freedom
You stop managing servers—and start designing systems.

🎯 Final Thoughts

That night changed how I think about infrastructure.

Before, I was reacting to problems.
Now, the system prevents them.

With **Microsoft Azure Autoscale, you’re not just scaling resources—you’re scaling your ability to operate efficiently, reliably, and intelligently.

And once you experience that shift…

You’ll never want to go back.

For years, the default way to connect networks across environments—on-premises, Azure, AWS—has been through traditional site-to-site VPNs. You deploy a VPN gateway, configure IPSec tunnels, manage pre-shared keys, deal with routing quirks, and pay a fixed monthly cost whether you use it heavily or not.

It works. But it’s heavy, rigid, and for many small-to-medium businesses, unnecessarily expensive.

So I explored a different approach—one that removes the dependency on traditional VPN gateways entirely. Instead of building tunnels between networks, I focused on building a secure, identity-based network overlay using Tailscale, and combining it with native cloud routing mechanisms like VNet peering and VPC peering.

What came out of that is a fully functional, multi-cloud network that behaves like a site-to-site VPN—but is far more flexible and cost-efficient.

🧭 Architecture at a Glance

🌐 The Idea: Don’t Tunnel Networks—Overlay Them

At the core of this design is a simple shift in thinking.

Instead of asking:

“How do I connect Site A to Site B with a tunnel?”

We ask:

“How do I make all sites part of the same secure network, regardless of where they live?”

This is exactly what Tailscale does.

Tailscale creates a private mesh network across all participating nodes using WireGuard. Every node gets an identity and a private IP, and communication between nodes is encrypted end-to-end. There’s no central VPN gateway, no single choke point—just direct, secure connectivity between peers.

But the real power comes when you introduce subnet routers.

🔑 Turning Individual Nodes into Network Gateways

In a normal Tailscale setup, only the devices running Tailscale can communicate. That’s useful, but not enough when you want entire subnets—like 192.168.0.0/24 or 10.0.1.0/24—to be reachable.

This is where subnet routers come in.

By enabling route advertisement on a node, you essentially tell Tailscale:

“If anyone needs to reach this subnet, send the traffic to me.”

For example, on an on-prem server:

tailscale up --advertise-routes=192.168.0.0/24

Now, any device in the Tailscale network can reach the entire on-prem subnet through that single node.

The same concept applies in the cloud.

• In Azure, a VM advertises 10.0.0.0/16
• In AWS N. Virginia, another VM advertises 172.0.1.0/24

These nodes stop being just servers—they become routing points between the overlay network and their local environments.

But for this to work correctly, one critical setting must be enabled:

sysctl -w net.ipv4.ip_forward=1

Without IP forwarding, the node can receive traffic—but won’t pass it along.

☁️ Azure: Acting as the Aggregation Layer

In Azure, I used two VNets—East US and Central US—connected via VNet peering. This part is important because Azure peering provides high-speed, low-latency private connectivity between networks without needing a gateway.

Inside East US, I deployed a Tailscale router VM and advertised the Azure address space.

Now, Azure effectively becomes a hub in the design. It can reach:

• On-prem via Tailscale
• AWS via Tailscale
• Other Azure VNets via peering

To make this work cleanly, Azure uses User Defined Routes (UDRs).

For example:

Destination: 172.0.0.0/16
Next hop: Tailscale router VM

This ensures that any traffic destined for AWS is forwarded into the Tailscale overlay instead of being dropped or sent to the internet.

At the same time, Network Security Groups (NSGs) must allow traffic from the AWS and on-prem CIDRs. Without that, packets arrive—but never make it to the VM.

☁️ AWS: Where Routing Gets Interesting

AWS introduces a key constraint that shapes the design:

VPC peering is not transitive.

This means AWS will not automatically route traffic from one VPC to another through a third VPC.

So if you have:

• N. Virginia (172.0.1.0/24)
• Oregon (172.0.2.0/24)

Even with peering in place, traffic won’t magically flow across multiple hops.

To solve this, I used the N. Virginia Tailscale router as a controlled transit point.

Here’s how it works in practice.

When Azure wants to reach a VM in Oregon:

1. The packet is sent to the Azure Tailscale router (via UDR)
2. It enters the Tailscale network (encrypted)
3. It reaches the AWS N. Virginia router
4. That router checks its route table:172.0.2.0/24 → VPC Peering (pcx-xxxx)
5. The packet is forwarded across the peering connection into Oregon

The return path follows the same logic in reverse.

This works not because AWS allows transitive routing—but because the N. Virginia router is acting as a Layer 3 forwarding device, making an explicit routing decision.

🏠 On-Prem: No Static IP, No Problem

On the on-prem side, things are surprisingly simple.

A single machine running Tailscale advertises the local subnet:

tailscale up --advertise-routes=192.168.0.0/24

That’s it.

There’s no need for:

• Static public IPs
• Port forwarding
• Edge firewall changes

Tailscale handles NAT traversal automatically. Even behind typical ISP setups, the on-prem network becomes fully reachable from Azure and AWS—securely and privately.

🔐 Security: Identity Over Perimeter

Traditional VPNs rely heavily on network boundaries—if you’re inside, you’re trusted.

This design flips that model.

• Every connection is encrypted using WireGuard
• Every node is authenticated via identity
• Access can be restricted using Tailscale ACLs, Azure NSGs, and AWS Security Groups

Instead of trusting a subnet, you trust who and what is connecting.

💰 Cost: Where This Really Shines

In a traditional setup, just enabling connectivity between Azure and AWS could require:

• Azure VPN Gateway
• AWS Site-to-Site VPN
• Possibly a Transit Gateway
• NAT Gateways for outbound access

Even a basic setup can easily exceed $200–$400 per month, before considering data transfer.

In this design, the only real cost is:

• A few small VMs acting as routers
• Minimal peering costs
• Tailscale (often free or low-tier)

That brings the cost down dramatically—often to under $30/month for the same functional outcome.

⚖️ What This Design Really Is

It’s tempting to call this a “site-to-site VPN,” but that’s not entirely accurate.

There are no static tunnels. No IPSec. No centralized gateways.

Instead, this is:

A multi-cloud, identity-based network built using an encrypted overlay (Tailscale) and native cloud routing (peering + route tables).

It behaves like a site-to-site network—but it’s far more flexible.

🧩 Scaling and High Availability

As demand grows, this design can evolve.

You can deploy multiple subnet routers advertising the same CIDR. Tailscale will automatically choose the best path, providing failover without complex routing protocols.

In cloud environments, you can go further:

• Azure VM Scale Sets
• AWS Auto Scaling Groups

High availability becomes a matter of adding more routers, not redesigning the network.

🏁 Final Thoughts

What started as an experiment turned into a clear realization:

You don’t always need heavy, traditional VPN infrastructure to build a secure, multi-site network.

By combining:

• Tailscale for secure overlay connectivity
• Cloud-native peering for efficient intra-cloud routing
• Proper route table design for traffic control

You can build a network that is:

• Secure
• Flexible
• Cost-efficient
• Multi-cloud ready

And most importantly—simple enough to deploy and manage without overengineering.

If you’re exploring hybrid or multi-cloud networking, this approach is worth considering. It challenges the default assumptions—and in many cases, delivers a better outcome with fewer moving parts.

Load balancers are one of those things you don’t notice—until your website goes down.

Whether you’re running a small business site or a production-grade application, relying on a single server is a risk you can’t afford. Downtime, traffic spikes, and maintenance windows shouldn’t mean your service disappears.

This article is Part 3 of a 3-part series, where I’ll walk you through deploying Kemp LoadMaster inside Proxmox, configuring it for a single website, and integrating it with Cloudflare. The goal is simple: build a reliable, production-ready setup without unnecessary complexity.

This is a practical, step-by-step guide—no theory overload, no vendor hype—just what actually works in real-world environments.

If you’re a system engineer, IT admin, or someone building a homelab or SMB infrastructure, this series will help you achieve high availability, better traffic control, and peace of mind.

Let’s build it.

🧭 Architecture

✅ Prerequisites

Before starting, make sure you have the following:

Infrastructure

• Kemp LoadMaster (VM or Hardware)
• At least one backend web server
• Internet access from Kemp LoadMaster

Accounts & Access

• Cloudflare account
• A registered domain name
• Admin access to:
  • Cloudflare Dashboard
  • Kemp LoadMaster Web UI

Network Requirements

• Outbound HTTPS (TCP 443) allowed from Kemp
• No inbound ports required when using Cloudflare Tunnel

Step 1: Login to CloudFlare Account

Step 2: Go to Connector Tunnel

• Zero Trust - > Network - > Connector

Step 3: Create and publish the Kemp Virtual IP.

Take Note: Do not publish the Kemp Console IP

• Select tunnel - > Edit
• Select the Published application routes tab
• Click Add a published application routes button

• Fill-up the following:
• Subdomain: `web2`
• Domain: `yourdomainame.com`
• Type: `http`
• URL: `192.168.200.102:5001' - this is the Virtual IP of the Kemp
• Click Save

Step 4: Test the new publish website

🎯 Final Thoughts

By combining Kemp LoadMaster + Cloudflare Tunnel, you get:

• Enterprise-grade security
• Zero exposed inbound ports
• Clean, scalable architecture
• Easy SSL and DNS management

This setup is ideal for:

• Production web applications
• Hybrid cloud environments
• Security-focused organizations

Part1 Deploying Kemp Load Balancer on Proxmox: Full Step-by-Step Setup Guide

Part2 Deploying Kemp Load Balancer on Proxmox: Full Step-by-Step Setup Guide

Load balancers are one of those things you don’t notice—until your website goes down.

Whether you’re running a small business site or a production-grade application, relying on a single server is a risk you can’t afford. Downtime, traffic spikes, and maintenance windows shouldn’t mean your service disappears.

This article is Part 2 of a 3-part series, where I’ll walk you through deploying Kemp LoadMaster inside Proxmox, configuring it for a single website, and integrating it with Cloudflare. The goal is simple: build a reliable, production-ready setup without unnecessary complexity.

This is a practical, step-by-step guide—no theory overload, no vendor hype—just what actually works in real-world environments.

If you’re a system engineer, IT admin, or someone building a homelab or SMB infrastructure, this series will help you achieve high availability, better traffic control, and peace of mind.

Let’s build it.

Create the Kemp Virtual Service

1. Login to LoadMaster Web UI:
   `https://<LoadMaster-IP>'
2. Go to Virtual Services → Add New

3. Set:
   1. Virtual Address: 192.168.200.102
   2. Port: 443
   3. Service Type: HTTPS
4. Click Add this Virtual Service
5. Add the Service Name and click Set NickName

✅ Quick test: From LoadMaster, ensure it can reach your web server IP(s).

Add the Real Server (single backend)

1. Open the newly created VIP

2. Under Real Servers → Add New

3. Enter:

• Real Server Address: backend-server-ip
• Port: 80 (or 443 if backend uses SSL)

4. Click Add This Real Server
5. Check the Status (it should be Green)

Part1 Deploying Kemp Load Balancer on Proxmox: Full Step-by-Step Setup Guide

Part3 Deploying Kemp Load Balancer on Proxmox: Full Step-by-Step Setup Guide

Load balancers are one of those things you don’t notice—until your website goes down.

Whether you’re running a small business site or a production-grade application, relying on a single server is a risk you can’t afford. Downtime, traffic spikes, and maintenance windows shouldn’t mean your service disappears.

This article is Part 1 of a 3-part series, where I’ll walk you through deploying Kemp LoadMaster inside Proxmox, configuring it for a single website, and integrating it with Cloudflare. The goal is simple: build a reliable, production-ready setup without unnecessary complexity.

This is a practical, step-by-step guide—no theory overload, no vendor hype—just what actually works in real-world environments.

If you’re a system engineer, IT admin, or someone building a homelab or SMB infrastructure, this series will help you achieve high availability, better traffic control, and peace of mind.

Let’s build it.

What you need

• Kemp LoadMaster image file:Best for Proxmox/KVM: qcow2Also works: vmdk (but import differs)
• VM resources (basic):CPU: 2 vCPURAM: 2–4 GBDisk: 20–30 GBNIC: VirtIO

Step 1 — Upload the image to Proxmox

Upload `LoadMaster.vmdk to a node path like:

• /var/lib/vz/template/LoadMaster.vmdk
  (or just SCP it anywhere)

Step 2 — Create an empty VM shell

In Proxmox GUI:

1. Create VM
2. Name: kemp-lm
3. OS: Linux
4. System:
   • BIOS: SeaBIOS (usually fine)
5. Disks:
   • You can put a tiny disk or skip if allowed
6. CPU/RAM: set your sizing
7. Network:
   • Model: VirtIO (paravirtualized)
   • Bridge: vmbr0 (or your LAN bridge)
8. Finish

Step 3 — Import the qcow2 disk into the VM

Pick your storage name (example: local-lvm or local).

Step 4 — Attach the imported disk as SCSI.

• Select kemplb - > Harwdware
• Select Unused Disk 0 and click Edit - > Add

Step 5 — Edit the Boot Order

• Select Option
• Select Boot Order

• Select SCSI and click OK

Start the Kemp VM

Wait for completion

Step 6. Network setup inside Kemp (first boot)

• Login to the console
• Assign IP Address
• Subnet mask
• Default gateway
• DNS

Step 7. Access the Web UI and update the license. Ensure you have proper login in Kemp

• Select the Free License Type and Continue

• Set a new Password

🥂 🎉 You have completed the setup of Kemp Load Balancer

Part2 Deploying Kemp Load Balancer on Proxmox: Full Step-by-Step Setup Guide

Part3 Deploying Kemp Load Balancer on Proxmox: Full Step-by-Step Setup Guide

Running out of disk space on Ubuntu is a classic problem — especially on servers or long-running systems.

Modern tools can automate disk resizing, but real Linux control comes from understanding how to extend partitions manually — the old-school way.

This guide walks through extending a disk partition on Ubuntu using traditional Linux tools, without relying on fancy GUIs or cloud automation.

Why Use the Old Way?

Manual partition extension gives you:

• Full visibility of disk layout
• Safer changes on production systems
• Better troubleshooting control
• Confidence when automation fails

If you manage servers, virtual machines, or legacy systems, this knowledge is essential.

Step-by-Step Guide for Extending Disk Partition

1. Check the Disk Space

2. Run CFDISK.
3. Select /dev/sda2.
4. Navigate to RESIZE - > WRITE - > yes -> Quit

5. Set Partition

6. type print (to list the disk)
7. type resizepart 2 (/dev/sda2)
8. exit

9. Resize the /dev/sda2

Thats it. Congratulati0ns!

📣 TL;DR

If you can safely extend a Linux partition using fdisk and resize2fs, you’re already ahead of most users.

Running your own blog doesn’t have to rely on managed platforms. In this guide, I’ll walk through installing Ghost CMS on Ubuntu, using a self-hosted setup that gives you full control over performance, security, and customization.

This article covers the complete installation process—from preparing the Ubuntu server and installing required dependencies, to deploying Ghost with production-ready settings.

If you’re looking to run a modern publishing platform on your own infrastructure—whether for learning, experimentation, or production use—this guide will help you get there with a clean and stable setup.

1. Build a VM container
2. Setup Ubuntu OS
3. Create New User
4. Add User to sudo
5. Run as ghost Account
6. Install MS Sql

sudo apt-get install mysql-server

7. Edit mysql

# Enter mysql
sudo mysql
# Update permissions
ALTER USER 'root'@'localhost' IDENTIFIED WITH 'mysql_native_password' BY '<your-new-root-password>';
# Reread permissions
FLUSH PRIVILEGES;
# exit mysql
exit

8. Install Node.js

sudo apt-get update
sudo apt-get install -y ca-certificates curl gnupg
sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | sudo gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg

# Create deb repository
NODE_MAJOR=22 # Use a supported version
echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_$NODE_MAJOR.x nodistro main" | sudo tee /etc/apt/sources.list.d/nodesource.list

# Run update and install
sudo apt-get update
sudo apt-get install nodejs -y

9. Install Ghost-Cli

sudo npm install ghost-cli@latest -g

10. Create Directory and Folder Permission

# Create directory: Change `sitename` to whatever you like
sudo mkdir -p /var/www/sitename

# Set directory owner: Replace <user> with the name of your user
sudo chown <user>:<user> /var/www/sitename

# Set the correct permissions
sudo chmod 775 /var/www/sitename

# Then navigate into it
cd /var/www/sitename

11. Run Install Process

ghost install

12. Some Questions while installing Ghost

? Enter your blog URL: https://blog.mutiangpili.com
? Enter your MySQL hostname: localhost
? Enter your MySQL username: root
? Enter your MySQL password: [hidden]
? Enter your Ghost database name: ghost_prod
? Do you wish to set up "ghost" mysql user? Yes
? Do you wish to set up Nginx? No
? Do you wish to set up Systemd? Yes
? Do you want to start Ghost? Yes

13. Congratulations! 🥂

Ghost was installed successfully! To complete setup of your publication, visit:

https://blog.mutiangpili.com/ghost/

It’s been a while since I last posted a blog on my Medium page: https://medium.com/@marlonmutya.

I’ve always wanted to have my own blog hosted on a self-managed server, and it took a few months to build a new machine to make that happen. It wasn’t as straightforward as it seemed—different environments come with different challenges.

This space is now open to everyone, and all opinions are welcome.

Cheers!

Keeping your security stack up to date is critical for maintaining visibility and compliance. Wazuh agents play a key role in collecting telemetry from endpoints and forwarding it to the Wazuh manager for analysis and alerting. In this post, I’ll walk you through a clean and reliable way to upgrade Wazuh agents — whether you’re managing a few servers or scaling across multiple environments.

📌 Why Upgrade the Wazuh Agent?

Upgrading agents ensures:

• ✅ Compatibility with the latest Wazuh Manager version
• 🔐 Security patches and performance improvements
• 🧰 Access to new monitoring modules and bug fixes
• 📊 Better stability for log collection and analysis

Running mismatched versions between the agent and the manager can cause communication issues or feature limitations. Keeping them aligned is a best practice in any SOC environment.

(Using CLI)

🧭 Step 1: Check the Current Agent Version

Before upgrading, check what version is currently installed:

⚙️ Step 2: Install the Wazuh Agent

(Using GUI)

Step 1: Login to the Wazuh Dashboard and verify the version of the Wazuh Agent

Step 2: Select the 3 dots and Click Upgrade

Step 3: Verify the Task

Step 4: Verify the task status is DONE and the Agent has been updated.

🌐 Automate at Scale (Optional)

For larger environments, consider using:

• Ansible / Puppet / Chef to roll out upgrades in batches
• SSH or remote execution tools to push updates to groups of servers
• Version pinning to ensure consistent agent versions across environments

✅ Final Thoughts

Upgrading Wazuh agents is a quick but essential maintenance task that strengthens your overall security posture. By following a structured approach — check → download → upgrade → validate — you minimize downtime and ensure your monitoring remains intact.

Ditch the clunky VPN. Discover how Twingate makes secure access faster, simpler, and way less rage-inducing.

Let’s be real VPNs feel like that old office printer: bulky, moody, and somehow always “offline” when you need it most. They’re supposed to make things secure, but half the time they just make your Netflix stream look like it was filmed on a potato.

Enter Twingate the VPN replacement that doesn’t give you headaches, doesn’t hog your bandwidth, and actually makes Zero Trust sound… kinda cool.

🕵️ What’s the Big Deal with VPNs Anyway?

Traditional VPNs are like building a giant castle wall and forcing everyone to come in through the same creaky drawbridge. Works fine if you’re defending against dragons, but in the 21st century, your company’s “castle” is scattered across AWS, GCP, Azure, and that one random NAS box under Bob’s desk.

• VPNs = bottleneck city
• Twingate = no bottlenecks, no drama.

⚡ How Twingate Flips the Script

Instead of dragging traffic through one central gateway (VPN-style), Twingate is like giving each employee their own invisibility cloak. They connect only to the resources they need, when they need them.

• Zero Trust? ✅
• Latency who? ❌
• Angry IT tickets titled “VPN SLOW!!!”? 🙌 Bye.

It’s like Grab or DoorDash for secure access: only the goodies you ordered, delivered right to you — no extra baggage.

😂 Relatable Techie Struggles Twingate Fixes

• That one guy on the VPN who accidentally nukes everyone’s bandwidth while “downloading Linux ISOs.”
• You forgetting to disconnect and then wondering why your Netflix is streaming at potato quality.
• Explaining to non-IT coworkers why the VPN “disconnects when you close your laptop” .

🛠️ The Nerdy Bits (Simplified)

• Zero Trust Network Access (ZTNA): Instead of trusting everyone inside the moat, assume nobody’s trustworthy until proven otherwise.
• Split tunneling done right: No more routing all your traffic through HQ just to check Slack.
• Deploy in minutes, not days: IT finally gets to drink their coffee hot.

🏁 Final Thoughts

Twingate feels less like a network tool and more like the moment you upgraded from a Nokia brick phone to a smartphone. Once you use it, you wonder how you ever survived without it.

So the next time someone complains about the VPN, just smile and say:
“Bro, we don’t do VPNs here. We Twingate.”

👉 Your move, VPNs. Time to retire.