I think an honeypot is always a good idea and it sure helps to know that you're being targeted but... > My main concern is, if an attacker has the ability to n

I think an honeypot is always a good idea and it sure helps to know that you're being targeted but... > My main concern is, if an attacker has the ability to nmap against my private IP range For a start I consider that chinese IoT shits and SmartTVs are attackers. So the attackers are already in my network. And if they're not, they've got very easy targets: these IoT (Internet-of-(Insecure-and-Shitty-)Things) devices. Note that you can run several LANs too. I've got 192.168.x. and 10.x.x.x. One is way more secure than the other (no WiFi device on the more secure one, a very strict firewall in between the two LANs, etc.). Heck, even my ISP by default hands a router that separates the home LAN and the "guests" LAN. A nmap from 192.168.x.x shall not give any result for stuff on 10.x.x.x and vice-versa. You can do it by configuring trunking / VLANs or physically. Mine is just physical: unmanaged switches, a few of them on one LAN, another one dedicated to the more secure LAN. The box that does the routing between the two LANs only does two things: firewalling and routing traffic. Nothing else. No SSH port open. No ports open whatsoever. No nothing. Firewalling and routing and that's it. > ... they're already in the network and I'm already pwned. Not really though. You should be able to work properly and securely if your main computer isn't compromised. It should really be no different than using a laptop from a public place.