I'm currently a senior help desk technician that gets extensive experience in several aspects of cybersecurity.

To make the eventual jump into cyber, I've been working on a lab using GNS3 and Suricata fine-tuning. It currently has two offices using OPNsense firewalls connected via an IPsec tunnel, and Suricata running on the firewalls in IDS mode. There is also a simulated attacker host connected to the ISP router.

I wanted to get advice on some things you'd be impressed by if you were to see them in a lab. So far the only thing I've really done is establish least privilege ACLs and also a web server in one office, which is the only thing the other office can reach

Please let me know if this is not the right sub for this. I also know it's very vague, but to be honest I don't have a very clear goal for the lab yet. I want to focus more on network security engineering, but I am also interested in detection engineering.