Homelab Vlan Segmentation

Segmenting home networks into VLANs for IoT, guest, trusted, and server traffic using UniFi, pfSense/OPNsense, and MikroTik — including switch trunk config, firewall rules, and wireless SSID mapping.

RajanthaR 9529cec 10.2 KB Updated Sep 9, 2026 0 repo stars

Coding & Dev Tools

Install

Press C to copy

$ npx skillmds add rajanthar/homelab-vlan-segmentation

Installs into ~/.claude/skills (or .claude/skills inside a project). Restart Claude Code to pick it up.

Download SKILL.md

＋ Add to collection

README badge

[![SkillMD](https://skillmd.com/badge/rajanthar/homelab-vlan-segmentation.svg)](https://skillmd.com/skills/rajanthar/homelab-vlan-segmentation)

Trust & safety

Audits pending

Not yet audited · commit 9529cec

Permissions this skill uses

Reads secrets
The instructions read tokens, keys, or other credentials.

Works with: Claude Code Claude.ai OpenAI Codex +

File contents

Homelab VLAN Segmentation

How to split a home network into isolated VLANs so IoT devices, guests, and your main PCs cannot talk to each other. The most impactful security upgrade for a home network.

All firewall rules shown here add isolation between segments — they do not remove existing protections. Apply changes in a maintenance window and verify connectivity between segments after each step before moving on.

When to Use

Setting up VLANs on a home network for the first time
Isolating IoT devices (smart bulbs, cameras, TVs) from trusted devices
Creating a guest Wi-Fi network that cannot reach home devices
Explaining how VLANs work to someone unfamiliar with the concept
Configuring trunk ports, access ports, and SSID-to-VLAN mapping
Troubleshooting inter-VLAN routing or firewall rule issues on pfSense/OPNsense/UniFi

How It Works

Without VLANs — flat network:
  All devices on 192.168.1.0/24
  Smart TV (potential malware) → can reach your NAS, PCs, everything

With VLANs:
  VLAN 10 — Trusted    192.168.10.0/24  (PCs, phones, laptops)
  VLAN 20 — IoT        192.168.20.0/24  (smart TV, bulbs, cameras)
  VLAN 30 — Servers    192.168.30.0/24  (NAS, Pi, VMs)
  VLAN 40 — Guest      192.168.40.0/24  (visitor Wi-Fi)
  VLAN 99 — Management 192.168.99.0/24  (switch/AP web UIs)

  Smart TV → blocked from reaching 192.168.10.0/24 and 192.168.30.0/24
  Guests → internet only, cannot see any home devices

VLAN Design Template

VLAN  Name        Subnet              Gateway         Purpose
10    trusted     192.168.10.0/24     192.168.10.1    PCs, phones, laptops
20    iot         192.168.20.0/24     192.168.20.1    Smart home devices
30    servers     192.168.30.0/24     192.168.30.1    NAS, Pi, self-hosted
40    guest       192.168.40.0/24     192.168.40.1    Visitor Wi-Fi
99    management  192.168.99.0/24     192.168.99.1    Network gear web UIs

Examples

Typical homelab with UniFi AP and managed switch:

Scenario: 3-bedroom house, UniFi Dream Machine + UniFi 8-port switch + 2 APs

VLAN 10 — Trusted    192.168.10.0/24   MacBook, iPhones, iPad
VLAN 20 — IoT        192.168.20.0/24   Nest thermostat, Philips Hue, Ring doorbell, smart TVs
VLAN 30 — Servers    192.168.30.0/24   Synology NAS (192.168.30.10), Pi-hole (192.168.30.2)
VLAN 40 — Guest      192.168.40.0/24   Visitor Wi-Fi — internet only

SSID → VLAN mapping:
  "Home"      → VLAN 10 (WPA2, strong password, trusted devices only)
  "IoT"       → VLAN 20 (WPA2, separate password, printed on router for setup)
  "Guest"     → VLAN 40 (WPA2, simple password you can share freely)

Switch port behavior:
  Port 1  → trunk to router (tagged VLANs 10,20,30,40,99)
  Port 2  → trunk to APs (tagged VLANs 10,20,40; AP handles per-SSID tagging)
  Port 3  → access VLAN 30 (NAS — untagged, no VLAN awareness needed)
  Port 4  → access VLAN 30 (Pi-hole — untagged)
  Port 5–8 → access VLAN 10 (wired workstations)

Firewall rules applied (all rules add isolation, none remove existing protections):
  IoT → Trusted: BLOCK
  IoT → Servers: BLOCK except 192.168.30.2:53 (Pi-hole DNS allowed)
  IoT → Internet: ALLOW
  Guest → Local networks: BLOCK
  Guest → Internet: ALLOW
  Trusted → everywhere: ALLOW

UniFi Configuration

Create Networks in UniFi Controller

Settings → Networks → Create New Network

For each VLAN:
  Name: IoT
  Purpose: Corporate  (gives DHCP + routing)
  VLAN ID: 20
  Network: 192.168.20.0/24
  Gateway IP: 192.168.20.1
  DHCP: Enable
  DHCP Range: 192.168.20.100 – 192.168.20.254

Map SSIDs to VLANs (UniFi)

Settings → WiFi → Create New WiFi

  Name: IoT-Network
  Password: <separate password>
  Network: IoT  ← select your VLAN here
  # All devices connecting to this SSID land in VLAN 20

  Name: Guest
  Password: <guest password>
  Network: Guest
  Guest Policy: Enable  ← isolates guests from each other too

UniFi Firewall Rules (Traffic Rules)

Settings → Traffic & Security → Traffic Rules

# Block IoT from reaching Trusted VLAN
  Action: Block
  Category: Local Network
  Source: IoT (192.168.20.0/24)
  Destination: Trusted (192.168.10.0/24)

# Allow IoT to reach internet only
  Action: Allow
  Source: IoT
  Destination: Internet

# Block Guest from all local networks
  Action: Block
  Source: Guest
  Destination: Local Networks

pfSense / OPNsense Configuration

Create VLANs

Interfaces → Assignments → VLANs → Add

  Parent Interface: em1  (your LAN NIC)
  VLAN Tag: 20
  Description: IoT

# Repeat for each VLAN, then assign each VLAN to an interface:
Interfaces → Assignments → Add
  Select the VLAN you created → click Add
  Enable the interface, set IP to gateway address (192.168.20.1/24)

DHCP for Each VLAN

Services → DHCP Server → Select your VLAN interface

  Enable DHCP
  Range: 192.168.20.100 to 192.168.20.254
  DNS Servers: 192.168.30.2  ← Pi-hole IP if you have one

Firewall Rules (pfSense/OPNsense)

# Rules are processed top-to-bottom, first match wins.

# On the IoT interface (VLAN 20):
  Rule 1: Allow IoT → Pi-hole DNS  ← MUST come before the RFC1918 block rule
    Protocol: UDP/TCP
    Source: IoT net
    Destination: 192.168.30.2 port 53
    Action: Allow

  Rule 2: Block IoT → RFC1918 (all private IP ranges)
    Protocol: any
    Source: IoT net
    Destination: RFC1918  (192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12)
    Action: Block

  Rule 3: Allow IoT → internet
    Protocol: any
    Source: IoT net
    Destination: any
    Action: Allow

# On the Trusted interface (VLAN 10):
  Allow all (trusted devices can reach everything)
    Source: Trusted net
    Destination: any
    Action: Allow

# Additional exceptions for IoT devices that need specific local services:
  Insert before Rule 2 (the RFC1918 block):
    Protocol: TCP
    Source: IoT net
    Destination: 192.168.30.x port 8123  ← Home Assistant
    Action: Allow

MikroTik Configuration

# Step 1: Create a bridge with VLAN filtering enabled
/interface bridge
add name=bridge vlan-filtering=yes

# Step 2: Add physical ports to the bridge
# Trunk port to router/uplink (tagged for all VLANs)
/interface bridge port
add bridge=bridge interface=ether1 frame-types=admit-only-vlan-tagged

# Access port for trusted devices (untagged VLAN 10)
/interface bridge port
add bridge=bridge interface=ether2 pvid=10 frame-types=admit-only-untagged-and-priority-tagged

# Access port for IoT devices (untagged VLAN 20)
/interface bridge port
add bridge=bridge interface=ether3 pvid=20 frame-types=admit-only-untagged-and-priority-tagged

# Step 3: Define which VLANs are allowed on which ports
/interface bridge vlan
add bridge=bridge tagged=ether1 untagged=ether2 vlan-ids=10
add bridge=bridge tagged=ether1 untagged=ether3 vlan-ids=20

# Step 4: Create VLAN interfaces on the bridge (gateway IPs)
/interface vlan
add interface=bridge name=vlan10 vlan-id=10
add interface=bridge name=vlan20 vlan-id=20

# Step 5: Assign gateway IPs
/ip address
add interface=vlan10 address=192.168.10.1/24
add interface=vlan20 address=192.168.20.1/24

# Step 6: DHCP pools and servers
/ip pool
add name=pool-trusted ranges=192.168.10.100-192.168.10.254
add name=pool-iot ranges=192.168.20.100-192.168.20.254

/ip dhcp-server
add interface=vlan10 address-pool=pool-trusted name=dhcp-trusted
add interface=vlan20 address-pool=pool-iot name=dhcp-iot

/ip dhcp-server network
add address=192.168.10.0/24 gateway=192.168.10.1
add address=192.168.20.0/24 gateway=192.168.20.1

# Step 7: Firewall — block IoT from reaching trusted VLAN
/ip firewall filter
add chain=forward src-address=192.168.20.0/24 dst-address=192.168.10.0/24 \
    action=drop comment="Block IoT to Trusted"

Switch Trunk vs Access Ports

# Trunk port: carries multiple VLANs (tagged) — connects switch-to-switch, switch-to-router, switch-to-AP
# Access port: carries one VLAN (untagged) — connects to end devices (PC, camera, NAS)

# A managed switch port connected to your router should be a trunk:
  Allowed VLANs: 10, 20, 30, 40, 99

# A port connecting to a PC should be an access port:
  VLAN: 10 (trusted)
  No tagging — the PC does not know or care about VLANs

# A port connecting to an AP must be a trunk:
  The AP tags traffic from each SSID with the right VLAN ID
  Allowed VLANs: 10, 20, 40  (whichever SSIDs the AP serves)

Anti-Patterns

# BAD: Creating VLANs without adding firewall rules
# VLANs without firewall rules do not provide security — inter-VLAN routing is open by default
# GOOD: Add explicit block rules immediately after creating VLANs

# BAD: Putting the Pi-hole in the IoT VLAN
# IoT devices can reach it but trusted devices cannot (without extra rules)
# GOOD: Pi-hole in the Servers VLAN with a rule allowing all VLANs to reach port 53

# BAD: Native VLAN equals management VLAN
# Untagged traffic landing in your management VLAN enables VLAN hopping attacks
# GOOD: Use a dedicated unused VLAN as native (e.g. VLAN 999), keep management traffic tagged

# BAD: Same Wi-Fi password for IoT SSID and trusted SSID
# Anyone who learns the password can connect IoT devices to the wrong segment

Best Practices

Start with 4 VLANs: Trusted, IoT, Servers, Guest — add more as needed
Put Pi-hole in the Servers VLAN (192.168.30.x)
Add a firewall rule allowing DNS (port 53) from all VLANs to the Pi-hole IP — before any RFC1918 block rule
Test isolation after every rule change: from the IoT VLAN, try to ping a trusted device — it should fail
Use a management VLAN for switch and AP web UIs and restrict access to the Trusted VLAN only
Document your VLAN design in a table (VLAN ID, name, subnet, purpose)

Related Skills

homelab-network-setup
homelab-pihole-dns
homelab-wireguard-vpn

---name: homelab-vlan-segmentationdescription: Segmenting home networks into VLANs for IoT, guest, trusted, and server traffic using UniFi, pfSense/OPNsense, and MikroTik — including switch trunk config, firewall rules, and wireless SSID mapping.--- # Homelab VLAN Segmentation How to split a home network into isolated VLANs so IoT devices, guests, and your main PCs cannot talk to each other. The most impactful security upgrade for a home network. All firewall rules shown here add isolation between segments — they do not remove existing protections. Apply changes in a maintenance window and verify connectivity between segments after each step before moving on. ## When to Use - Setting up VLANs on a home network for the first time - Isolating IoT devices (smart bulbs, cameras, TVs) from trusted devices - Creating a guest Wi-Fi network that cannot reach home devices - Explaining how VLANs work to someone unfamiliar with the concept - Configuring trunk ports, access ports, and SSID-to-VLAN mapping - Troubleshooting inter-VLAN routing or firewall rule issues on pfSense/OPNsense/UniFi ## How It Works ``` Without VLANs — flat network: All devices on 192.168.1.0/24 Smart TV (potential malware) → can reach your NAS, PCs, everything With VLANs: VLAN 10 — Trusted 192.168.10.0/24 (PCs, phones, laptops) VLAN 20 — IoT 192.168.20.0/24 (smart TV, bulbs, cameras) VLAN 30 — Servers 192.168.30.0/24 (NAS, Pi, VMs) VLAN 40 — Guest 192.168.40.0/24 (visitor Wi-Fi) VLAN 99 — Management 192.168.99.0/24 (switch/AP web UIs) Smart TV → blocked from reaching 192.168.10.0/24 and 192.168.30.0/24 Guests → internet only, cannot see any home devices ``` ## VLAN Design Template ``` VLAN Name Subnet Gateway Purpose 10 trusted 192.168.10.0/24 192.168.10.1 PCs, phones, laptops 20 iot 192.168.20.0/24 192.168.20.1 Smart home devices 30 servers 192.168.30.0/24 192.168.30.1 NAS, Pi, self-hosted 40 guest 192.168.40.0/24 192.168.40.1 Visitor Wi-Fi 99 management 192.168.99.0/24 192.168.99.1 Network gear web UIs ``` ## Examples **Typical homelab with UniFi AP and managed switch:** ``` Scenario: 3-bedroom house, UniFi Dream Machine + UniFi 8-port switch + 2 APs VLAN 10 — Trusted 192.168.10.0/24 MacBook, iPhones, iPad VLAN 20 — IoT 192.168.20.0/24 Nest thermostat, Philips Hue, Ring doorbell, smart TVs VLAN 30 — Servers 192.168.30.0/24 Synology NAS (192.168.30.10), Pi-hole (192.168.30.2) VLAN 40 — Guest 192.168.40.0/24 Visitor Wi-Fi — internet only SSID → VLAN mapping: "Home" → VLAN 10 (WPA2, strong password, trusted devices only) "IoT" → VLAN 20 (WPA2, separate password, printed on router for setup) "Guest" → VLAN 40 (WPA2, simple password you can share freely) Switch port behavior: Port 1 → trunk to router (tagged VLANs 10,20,30,40,99) Port 2 → trunk to APs (tagged VLANs 10,20,40; AP handles per-SSID tagging) Port 3 → access VLAN 30 (NAS — untagged, no VLAN awareness needed) Port 4 → access VLAN 30 (Pi-hole — untagged) Port 5–8 → access VLAN 10 (wired workstations) Firewall rules applied (all rules add isolation, none remove existing protections): IoT → Trusted: BLOCK IoT → Servers: BLOCK except 192.168.30.2:53 (Pi-hole DNS allowed) IoT → Internet: ALLOW Guest → Local networks: BLOCK Guest → Internet: ALLOW Trusted → everywhere: ALLOW ``` ## UniFi Configuration ### Create Networks in UniFi Controller ``` Settings → Networks → Create New Network For each VLAN: Name: IoT Purpose: Corporate (gives DHCP + routing) VLAN ID: 20 Network: 192.168.20.0/24 Gateway IP: 192.168.20.1 DHCP: Enable DHCP Range: 192.168.20.100 – 192.168.20.254 ``` ### Map SSIDs to VLANs (UniFi) ``` Settings → WiFi → Create New WiFi Name: IoT-Network Password: <separate password> Network: IoT ← select your VLAN here # All devices connecting to this SSID land in VLAN 20 Name: Guest Password: <guest password> Network: Guest Guest Policy: Enable ← isolates guests from each other too ``` ### UniFi Firewall Rules (Traffic Rules) ``` Settings → Traffic & Security → Traffic Rules # Block IoT from reaching Trusted VLAN Action: Block Category: Local Network Source: IoT (192.168.20.0/24) Destination: Trusted (192.168.10.0/24) # Allow IoT to reach internet only Action: Allow Source: IoT Destination: Internet # Block Guest from all local networks Action: Block Source: Guest Destination: Local Networks ``` ## pfSense / OPNsense Configuration ### Create VLANs ``` Interfaces → Assignments → VLANs → Add Parent Interface: em1 (your LAN NIC) VLAN Tag: 20 Description: IoT # Repeat for each VLAN, then assign each VLAN to an interface: Interfaces → Assignments → Add Select the VLAN you created → click Add Enable the interface, set IP to gateway address (192.168.20.1/24) ``` ### DHCP for Each VLAN ``` Services → DHCP Server → Select your VLAN interface Enable DHCP Range: 192.168.20.100 to 192.168.20.254 DNS Servers: 192.168.30.2 ← Pi-hole IP if you have one ``` ### Firewall Rules (pfSense/OPNsense) ``` # Rules are processed top-to-bottom, first match wins. # On the IoT interface (VLAN 20): Rule 1: Allow IoT → Pi-hole DNS ← MUST come before the RFC1918 block rule Protocol: UDP/TCP Source: IoT net Destination: 192.168.30.2 port 53 Action: Allow Rule 2: Block IoT → RFC1918 (all private IP ranges) Protocol: any Source: IoT net Destination: RFC1918 (192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12) Action: Block Rule 3: Allow IoT → internet Protocol: any Source: IoT net Destination: any Action: Allow # On the Trusted interface (VLAN 10): Allow all (trusted devices can reach everything) Source: Trusted net Destination: any Action: Allow # Additional exceptions for IoT devices that need specific local services: Insert before Rule 2 (the RFC1918 block): Protocol: TCP Source: IoT net Destination: 192.168.30.x port 8123 ← Home Assistant Action: Allow ``` ## MikroTik Configuration ``` # Step 1: Create a bridge with VLAN filtering enabled /interface bridge add name=bridge vlan-filtering=yes # Step 2: Add physical ports to the bridge # Trunk port to router/uplink (tagged for all VLANs) /interface bridge port add bridge=bridge interface=ether1 frame-types=admit-only-vlan-tagged # Access port for trusted devices (untagged VLAN 10) /interface bridge port add bridge=bridge interface=ether2 pvid=10 frame-types=admit-only-untagged-and-priority-tagged # Access port for IoT devices (untagged VLAN 20) /interface bridge port add bridge=bridge interface=ether3 pvid=20 frame-types=admit-only-untagged-and-priority-tagged # Step 3: Define which VLANs are allowed on which ports /interface bridge vlan add bridge=bridge tagged=ether1 untagged=ether2 vlan-ids=10 add bridge=bridge tagged=ether1 untagged=ether3 vlan-ids=20 # Step 4: Create VLAN interfaces on the bridge (gateway IPs) /interface vlan add interface=bridge name=vlan10 vlan-id=10 add interface=bridge name=vlan20 vlan-id=20 # Step 5: Assign gateway IPs /ip address add interface=vlan10 address=192.168.10.1/24 add interface=vlan20 address=192.168.20.1/24 # Step 6: DHCP pools and servers /ip pool add name=pool-trusted ranges=192.168.10.100-192.168.10.254 add name=pool-iot ranges=192.168.20.100-192.168.20.254 /ip dhcp-server add interface=vlan10 address-pool=pool-trusted name=dhcp-trusted add interface=vlan20 address-pool=pool-iot name=dhcp-iot /ip dhcp-server network add address=192.168.10.0/24 gateway=192.168.10.1 add address=192.168.20.0/24 gateway=192.168.20.1 # Step 7: Firewall — block IoT from reaching trusted VLAN /ip firewall filter add chain=forward src-address=192.168.20.0/24 dst-address=192.168.10.0/24 \ action=drop comment="Block IoT to Trusted" ``` ## Switch Trunk vs Access Ports ``` # Trunk port: carries multiple VLANs (tagged) — connects switch-to-switch, switch-to-router, switch-to-AP # Access port: carries one VLAN (untagged) — connects to end devices (PC, camera, NAS) # A managed switch port connected to your router should be a trunk: Allowed VLANs: 10, 20, 30, 40, 99 # A port connecting to a PC should be an access port: VLAN: 10 (trusted) No tagging — the PC does not know or care about VLANs # A port connecting to an AP must be a trunk: The AP tags traffic from each SSID with the right VLAN ID Allowed VLANs: 10, 20, 40 (whichever SSIDs the AP serves) ``` ## Anti-Patterns ``` # BAD: Creating VLANs without adding firewall rules # VLANs without firewall rules do not provide security — inter-VLAN routing is open by default # GOOD: Add explicit block rules immediately after creating VLANs # BAD: Putting the Pi-hole in the IoT VLAN # IoT devices can reach it but trusted devices cannot (without extra rules) # GOOD: Pi-hole in the Servers VLAN with a rule allowing all VLANs to reach port 53 # BAD: Native VLAN equals management VLAN # Untagged traffic landing in your management VLAN enables VLAN hopping attacks # GOOD: Use a dedicated unused VLAN as native (e.g. VLAN 999), keep management traffic tagged # BAD: Same Wi-Fi password for IoT SSID and trusted SSID # Anyone who learns the password can connect IoT devices to the wrong segment ``` ## Best Practices - Start with 4 VLANs: Trusted, IoT, Servers, Guest — add more as needed - Put Pi-hole in the Servers VLAN (192.168.30.x) - Add a firewall rule allowing DNS (port 53) from all VLANs to the Pi-hole IP — before any RFC1918 block rule - Test isolation after every rule change: from the IoT VLAN, try to ping a trusted device — it should fail - Use a management VLAN for switch and AP web UIs and restrict access to the Trusted VLAN only - Document your VLAN design in a table (VLAN ID, name, subnet, purpose) ## Related Skills - homelab-network-setup - homelab-pihole-dns - homelab-wireguard-vpn

RajanthaR/0-Rajantha-SKILLS/tree/main/skills/Infrastructure-Networking-and-Hardware/Networking-and-Homelab/homelab-vlan-segmentation commit 9529cec5de

Frequently asked questions

npx skillmds add rajanthar/homelab-vlan-segmentation