A lab you are afraid to break is not a lab. The whole point is that you can leave a box in a ruined state at 2am and roll it back before breakfast. That single property, cheap rollback, matters far more than the hardware you run it on.
Segment first, install second
The most common mistake is building the lab flat and bridging it straight onto the home network. Put the lab behind its own firewall interface with no route back to your personal devices. If a target box ends up fully compromised during an exercise, the blast radius should stop at the VLAN boundary.
# three VLANs is enough to start
# 10 - management (hypervisor, firewall admin)
# 20 - targets (deliberately vulnerable VMs, no egress)
# 30 - attacker (your working VM)Give the target VLAN no outbound internet at all. It removes an entire class of accidents, and it forces you to stage tooling deliberately rather than pulling it off the internet mid-exercise.
Snapshot discipline
Snapshot every target VM in its clean state before the first packet. Name it something you will still understand later. The temptation is to keep working on a box you have already modified, but findings from a dirty machine are not reproducible, and non-reproducible findings are just anecdotes.
Write it down as you go
Keep a terminal log and a scratch file open from the start. Reconstructing what you did three hours ago from shell history is miserable, and the details you lose are exactly the ones that made the difference.