Nmap Homelab Guide

Problem

Most nmap tutorials target CTF environments or intentionally vulnerable machines. There was no structured guide focused on scanning and hardening a real homelab network — the kind of network where you actually care about the results.

What I Built

A 10-module guide that walks through practical nmap usage on a homelab network. Each module covers a specific scanning technique and connects it directly to a hardening action:

1. Host discovery on the local subnet
2. Port scanning techniques and their tradeoffs
3. Service version detection
4. OS fingerprinting
5. NSE (Nmap Scripting Engine) basics
6. Vulnerability scanning with NSE scripts
7. Scanning through firewalls and IDS evasion
8. Output formats and reporting
9. Automating scans with Bash scripts
10. Building a hardening checklist from scan results

Stack

• Primary tool: nmap
• Environment: Arch Linux homelab network
• Scripting: Bash for automation

What I Learned

• Running nmap against your own infrastructure reveals services you forgot were running — Syncthing’s default web UI was exposed on a port I hadn’t firewalled.
• The gap between “scanning for vulnerabilities” and “actually hardening based on findings” is where most guides stop. Bridging that gap is where the real value is.
• NSE scripts are powerful but need careful vetting — some scripts are actively intrusive and shouldn’t be run against production services without understanding what they do.

Outcome

A complete, structured guide that takes someone from basic host discovery to producing an actionable hardening checklist for their own network.