Networking intermediate ⏱ 60 minutes

Network Segmentation: Proper Isolation Guide

Secure your homelab with proper network segmentation. VLANs, firewall rules, and DMZ setup.

By homelabbing.io • 2025-12-17
#segmentation#vlan#firewall#security#isolation

Network segmentation is the practice of dividing a network into multiple isolated segments to improve security, performance, and management. In a homelab environment, proper segmentation protects critical systems, contains potential security breaches, and allows for safe experimentation with new technologies.

Why Network Segmentation Matters

Security Benefits

  1. Breach Containment - Limit lateral movement of attackers
  2. Reduced Attack Surface - Minimize exposure of critical systems
  3. Defense in Depth - Multiple security layers
  4. Compliance - Meet security standards and best practices
  5. IoT Isolation - Contain insecure devices

Performance Benefits

  1. Reduced Broadcast Traffic - Smaller broadcast domains
  2. Better QoS - Prioritize critical traffic
  3. Optimized Routing - Efficient packet forwarding
  4. Bandwidth Management - Prevent network congestion

Management Benefits

  1. Logical Organization - Group similar devices
  2. Simplified Troubleshooting - Isolate network issues
  3. Flexible Policy Application - Apply rules per segment
  4. Easier Monitoring - Track segment-specific metrics

Network Segmentation Strategies

All Devices on 192.168.1.0/24:
    [Router] - [Switch] - [All Devices]
                           ├─ Servers
                           ├─ Workstations
                           ├─ IoT Devices
                           ├─ Guest Devices
                           └─ Management Interfaces

Problems: No isolation, single broadcast domain, difficult to secure

Basic Segmentation

Segmented Network:
    [Router/Firewall]
        ├─ LAN (192.168.1.0/24)    - Trusted devices
        ├─ DMZ (192.168.10.0/24)   - Exposed services
        ├─ IoT (192.168.20.0/24)   - Smart devices
        └─ Guest (192.168.99.0/24) - Visitors

Advanced Micro-Segmentation

Micro-Segmented Network:
    [Core Firewall]
        ├─ Management VLAN 10 (10.0.10.0/24)
        │   ├─ ESXi/Proxmox hosts
        │   ├─ Switch management
        │   └─ IPMI/iLO interfaces
        ├─ Server VLAN 20 (10.0.20.0/24)
        │   ├─ Production VMs
        │   ├─ Docker hosts
        │   └─ Kubernetes cluster
        ├─ Storage VLAN 30 (10.0.30.0/24)
        │   ├─ NAS/SAN devices
        │   ├─ Backup servers
        │   └─ Storage replication
        ├─ Application VLAN 40 (10.0.40.0/24)
        │   ├─ Web servers
        │   ├─ API servers
        │   └─ Application servers
        ├─ Database VLAN 50 (10.0.50.0/24)
        │   ├─ PostgreSQL
        │   ├─ MySQL
        │   └─ Redis
        ├─ IoT VLAN 60 (10.0.60.0/24)
        │   ├─ Smart home devices
        │   ├─ Cameras
        │   └─ Sensors
        ├─ User VLAN 70 (10.0.70.0/24)
        │   ├─ Workstations
        │   ├─ Laptops
        │   └─ Personal devices
        ├─ Lab VLAN 80 (10.0.80.0/24)
        │   ├─ Test VMs
        │   ├─ Development
        │   └─ Experimentation
        └─ Guest VLAN 99 (10.0.99.0/24)
            └─ Visitor devices

VLAN Configuration

VLAN Planning

VLAN ID Assignment

VLAN ID Structure:
    1       - Default/Native VLAN (unused)
    10-19   - Management and Infrastructure
    20-39   - Server and Production
    40-59   - Applications and Services
    60-79   - IoT and Automation
    80-89   - Development and Testing
    90-99   - Guest and Untrusted
    100+    - Site-specific or future use

IP Address Scheme

Subnet Planning:
    Management:     10.0.10.0/24    (254 hosts)
    Servers:        10.0.20.0/24    (254 hosts)
    Storage:        10.0.30.0/23    (510 hosts, large storage network)
    Applications:   10.0.40.0/24    (254 hosts)
    Databases:      10.0.50.0/25    (126 hosts, smaller database count)
    IoT:            10.0.60.0/23    (510 hosts, many IoT devices)
    Users:          10.0.70.0/22    (1022 hosts, large user network)
    Lab:            10.0.80.0/24    (254 hosts)
    Guest:          10.0.99.0/24    (254 hosts)

Switch Configuration

Managed Switch VLAN Setup (Cisco-style)

! Create VLANs
vlan 10
 name MANAGEMENT
vlan 20
 name SERVERS
vlan 30
 name STORAGE
vlan 40
 name APPLICATIONS
vlan 50
 name DATABASES
vlan 60
 name IOT
vlan 70
 name USERS
vlan 80
 name LAB
vlan 99
 name GUEST

! Configure trunk port to router/firewall
interface GigabitEthernet0/1
 description Trunk to Firewall
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,50,60,70,80,99
 switchport trunk native vlan 999

! Configure access ports
interface GigabitEthernet0/10
 description Server Port
 switchport mode access
 switchport access vlan 20
 spanning-tree portfast

interface GigabitEthernet0/20
 description IoT Device
 switchport mode access
 switchport access vlan 60
 spanning-tree portfast

interface GigabitEthernet0/30
 description User Workstation
 switchport mode access
 switchport access vlan 70
 spanning-tree portfast

Linux Bridge with VLANs

# Install bridge utilities
sudo apt-get install bridge-utils vlan

# Enable 8021q module
sudo modprobe 8021q
echo "8021q" | sudo tee -a /etc/modules

# Create VLAN interfaces
sudo ip link add link eth0 name eth0.10 type vlan id 10
sudo ip link add link eth0 name eth0.20 type vlan id 20
sudo ip link add link eth0 name eth0.60 type vlan id 60

# Bring interfaces up
sudo ip link set eth0.10 up
sudo ip link set eth0.20 up
sudo ip link set eth0.60 up

# Create bridges
sudo brctl addbr br-mgmt
sudo brctl addbr br-servers
sudo brctl addbr br-iot

# Add VLAN interfaces to bridges
sudo brctl addif br-mgmt eth0.10
sudo brctl addif br-servers eth0.20
sudo brctl addif br-iot eth0.60

# Bring bridges up
sudo ip link set br-mgmt up
sudo ip link set br-servers up
sudo ip link set br-iot up

Netplan Configuration (Ubuntu)

# /etc/netplan/01-network.yaml
network:
  version: 2
  renderer: networkd
  ethernets:
    enp1s0:
      dhcp4: no

  vlans:
    vlan10:
      id: 10
      link: enp1s0
      addresses:
        - 10.0.10.2/24
      routes:
        - to: default
          via: 10.0.10.1

    vlan20:
      id: 20
      link: enp1s0
      addresses:
        - 10.0.20.2/24

    vlan30:
      id: 30
      link: enp1s0
      addresses:
        - 10.0.30.2/24

    vlan60:
      id: 60
      link: enp1s0
      addresses:
        - 10.0.60.2/24

Apply configuration:

sudo netplan apply

Open vSwitch Configuration

# Install Open vSwitch
sudo apt-get install openvswitch-switch

# Create bridge
sudo ovs-vsctl add-br ovs-br0

# Add physical interface
sudo ovs-vsctl add-port ovs-br0 eth0

# Create VLAN interfaces
sudo ovs-vsctl add-port ovs-br0 vlan10 tag=10 -- set interface vlan10 type=internal
sudo ovs-vsctl add-port ovs-br0 vlan20 tag=20 -- set interface vlan20 type=internal
sudo ovs-vsctl add-port ovs-br0 vlan60 tag=60 -- set interface vlan60 type=internal

# Assign IP addresses
sudo ip addr add 10.0.10.2/24 dev vlan10
sudo ip addr add 10.0.20.2/24 dev vlan20
sudo ip addr add 10.0.60.2/24 dev vlan60

# Bring interfaces up
sudo ip link set vlan10 up
sudo ip link set vlan20 up
sudo ip link set vlan60 up

Firewall Configuration

pfSense VLAN and Firewall Setup

Interface Configuration

  1. Create VLAN Interfaces

    • Interfaces → Assignments → VLANs
    • Add VLANs 10, 20, 30, 40, 50, 60, 70, 80, 99

  2. Assign Interfaces

    • Interfaces → Assignments
    • Add each VLAN as a new interface
    • Enable and configure with appropriate IP

Firewall Rules Example

Management VLAN (10.0.10.0/24) Rules:
    Priority  Action  Protocol  Source          Destination      Ports
    1         Pass    *         10.0.10.0/24    10.0.10.0/24    *        (Intra-VLAN)
    2         Pass    TCP       10.0.10.0/24    10.0.20.0/24    22,443   (SSH to servers)
    3         Pass    ICMP      10.0.10.0/24    *               *        (Ping)
    4         Block   *         10.0.10.0/24    *               *        (Default deny)

Server VLAN (10.0.20.0/24) Rules:
    Priority  Action  Protocol  Source          Destination      Ports
    1         Pass    *         10.0.20.0/24    10.0.20.0/24    *        (Intra-VLAN)
    2         Pass    TCP       10.0.70.0/24    10.0.20.0/24    80,443   (Users to web)
    3         Pass    TCP       10.0.40.0/24    10.0.50.0/24    3306,5432(Apps to DB)
    4         Pass    *         10.0.20.0/24    0.0.0.0/0       *        (Internet access)
    5         Block   *         *               10.0.20.0/24    *        (Default deny inbound)

IoT VLAN (10.0.60.0/24) Rules:
    Priority  Action  Protocol  Source          Destination      Ports
    1         Pass    *         10.0.60.0/24    10.0.60.0/24    *        (Intra-VLAN)
    2         Pass    TCP/UDP   10.0.60.0/24    0.0.0.0/0       53,123   (DNS, NTP)
    3         Pass    TCP       10.0.60.0/24    YOUR-SERVER-IP  443      (Cloud services)
    4         Block   *         10.0.60.0/24    10.0.0.0/8      *        (No internal access)
    5         Block   *         10.0.60.0/24    192.168.0.0/16  *        (No internal access)
    6         Block   *         10.0.60.0/24    172.16.0.0/12   *        (No internal access)

Guest VLAN (10.0.99.0/24) Rules:
    Priority  Action  Protocol  Source          Destination      Ports
    1         Pass    TCP/UDP   10.0.99.0/24    0.0.0.0/0       53,80,443(Internet only)
    2         Block   *         10.0.99.0/24    10.0.0.0/8      *        (No internal access)
    3         Block   *         10.0.99.0/24    192.168.0.0/16  *        (No internal access)
    4         Block   *         10.0.99.0/24    172.16.0.0/12   *        (No internal access)

iptables/nftables Configuration

iptables Example

#!/bin/bash
# /etc/iptables/segmentation-rules.sh

# Flush existing rules
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X

# Default policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Allow loopback
iptables -A INPUT -i lo -j ACCEPT

# Allow established connections
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Management VLAN (10.0.10.0/24)
# Allow management to access all VLANs
iptables -A FORWARD -s 10.0.10.0/24 -j ACCEPT

# Server VLAN (10.0.20.0/24)
# Allow servers to access internet
iptables -A FORWARD -s 10.0.20.0/24 -o eth0 -j ACCEPT

# Allow users to access servers on HTTP/HTTPS
iptables -A FORWARD -s 10.0.70.0/24 -d 10.0.20.0/24 -p tcp -m multiport --dports 80,443 -j ACCEPT

# Application to Database
iptables -A FORWARD -s 10.0.40.0/24 -d 10.0.50.0/24 -p tcp -m multiport --dports 3306,5432 -j ACCEPT

# IoT VLAN (10.0.60.0/24)
# Allow IoT internet access only
iptables -A FORWARD -s 10.0.60.0/24 -o eth0 -p tcp -m multiport --dports 53,80,443 -j ACCEPT
iptables -A FORWARD -s 10.0.60.0/24 -o eth0 -p udp -m multiport --dports 53,123 -j ACCEPT

# Block IoT from accessing internal networks
iptables -A FORWARD -s 10.0.60.0/24 -d 10.0.0.0/8 -j DROP
iptables -A FORWARD -s 10.0.60.0/24 -d 192.168.0.0/16 -j DROP
iptables -A FORWARD -s 10.0.60.0/24 -d 172.16.0.0/12 -j DROP

# Guest VLAN (10.0.99.0/24)
# Internet only
iptables -A FORWARD -s 10.0.99.0/24 -o eth0 -p tcp -m multiport --dports 80,443 -j ACCEPT
iptables -A FORWARD -s 10.0.99.0/24 -o eth0 -p udp --dport 53 -j ACCEPT

# Block all other guest traffic
iptables -A FORWARD -s 10.0.99.0/24 -j DROP

# NAT for internet access
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# Logging
iptables -A FORWARD -j LOG --log-prefix "FW-DROP: " --log-level 4

# Save rules
iptables-save > /etc/iptables/rules.v4

nftables Configuration

# /etc/nftables.conf

flush ruleset

table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;

        # Allow loopback
        iif lo accept

        # Allow established/related
        ct state established,related accept

        # Allow SSH from management VLAN
        iifname vlan10 tcp dport 22 accept

        # Allow ICMP
        ip protocol icmp accept
        meta l4proto ipv6-icmp accept
    }

    chain forward {
        type filter hook forward priority 0; policy drop;

        # Allow established/related
        ct state established,related accept

        # Management VLAN - full access
        iifname vlan10 accept

        # Server VLAN rules
        iifname vlan20 oifname eth0 accept  # Internet access
        iifname vlan70 oifname vlan20 tcp dport { 80, 443 } accept  # User to web

        # Application to Database
        iifname vlan40 oifname vlan50 tcp dport { 3306, 5432 } accept

        # IoT VLAN - restricted
        iifname vlan60 oifname eth0 tcp dport { 53, 80, 443 } accept
        iifname vlan60 oifname eth0 udp dport { 53, 123 } accept
        iifname vlan60 ip daddr { 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12 } drop

        # Guest VLAN - internet only
        iifname vlan99 oifname eth0 tcp dport { 80, 443 } accept
        iifname vlan99 oifname eth0 udp dport 53 accept
        iifname vlan99 drop

        # Log dropped packets
        log prefix "nft-drop: " drop
    }

    chain output {
        type filter hook output priority 0; policy accept;
    }
}

table ip nat {
    chain postrouting {
        type nat hook postrouting priority 100; policy accept;

        # NAT for internet access
        oifname eth0 masquerade
    }
}

Apply configuration:

sudo nft -f /etc/nftables.conf
sudo systemctl enable nftables

Zero-Trust Architecture

Principles

  1. Never Trust, Always Verify - Authenticate every request
  2. Least Privilege Access - Minimum necessary permissions
  3. Assume Breach - Design for compromise scenarios
  4. Verify Explicitly - Use all available data points
  5. Micro-Segmentation - Granular network controls

Implementation Strategy

Traditional Perimeter Security:
    Trusted ←→ Firewall ←→ Untrusted
    (Full access)      (No access)

Zero-Trust Model:
    Device ← Authentication → Policy Engine → Resource
       ↓                           ↓              ↑
    Context                   Authorization    Continuous
    (User, Location,          Decision         Monitoring
     Device Health)

Zero-Trust with Software-Defined Perimeter

OpenZiti Implementation

Install OpenZiti:

# Install OpenZiti controller
docker run -d   --name ziti-controller   -p 6262:6262   -p 10000:10000   -v /opt/ziti/controller:/persistent   openziti/ziti-controller:latest

Create network:

# Initialize controller
ziti edge create identity user user1 -o user1.jwt
ziti edge create service web-service

# Create policies
ziti edge create service-policy web-access Dial   --identity-roles '#users'   --service-roles '#web-services'

# Create router
ziti edge create edge-router edge-router-1

WireGuard Zero-Trust

# /etc/wireguard/wg0.conf - Zero-Trust Gateway

[Interface]
Address = 10.99.0.1/24
PrivateKey = SERVER_PRIVATE_KEY
ListenPort = 51820

# Zero-trust rules - explicit allow only
PostUp = iptables -A FORWARD -i %i -o %i -j DROP
PostUp = iptables -A FORWARD -i %i -d 10.0.20.100 -p tcp --dport 443 -j ACCEPT
PostUp = iptables -A FORWARD -i %i -d 10.0.50.10 -p tcp --dport 5432 -m owner --uid-owner 1001 -j ACCEPT

# Per-user access control
[Peer]
# Admin user - full access
PublicKey = ADMIN_PUBLIC_KEY
AllowedIPs = 10.99.0.10/32

[Peer]
# Developer - limited access
PublicKey = DEV_PUBLIC_KEY
AllowedIPs = 10.99.0.20/32

[Peer]
# Guest - no internal access
PublicKey = GUEST_PUBLIC_KEY
AllowedIPs = 10.99.0.30/32

Micro-Segmentation with Docker

Docker Network Isolation

# docker-compose.yml with network segmentation

version: '3.8'

networks:
  frontend:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.1.0/24

  backend:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.2.0/24
    internal: true  # No internet access

  database:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.3.0/24
    internal: true  # No internet access

services:
  nginx:
    image: nginx:latest
    networks:
      - frontend
    ports:
      - "80:80"

  app:
    image: myapp:latest
    networks:
      - frontend
      - backend
    depends_on:
      - database

  database:
    image: postgres:latest
    networks:
      - database
    environment:
      POSTGRES_PASSWORD: secret

  # Connector for backend to database
  backend-connector:
    image: alpine:latest
    command: sleep infinity
    networks:
      - backend
      - database

Kubernetes Network Policies

# Deny all traffic by default
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

---

# Allow frontend to backend
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: frontend-to-backend
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 8080

---

# Allow backend to database
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: backend-to-database
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: database
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: backend
    ports:
    - protocol: TCP
      port: 5432

---

# Allow DNS and internet for frontend
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: frontend-egress
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: frontend
  policyTypes:
  - Egress
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          name: kube-system
    ports:
    - protocol: UDP
      port: 53
  - to:
    - podSelector: {}
    ports:
    - protocol: TCP
      port: 8080
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
        except:
        - 10.0.0.0/8
        - 192.168.0.0/16
        - 172.16.0.0/12

Advanced Security Measures

Private VLANs (PVLANs)

! Configure primary VLAN
vlan 60
 name IOT-PRIMARY
 private-vlan primary
 private-vlan association 61,62

! Isolated VLAN (devices can't talk to each other)
vlan 61
 name IOT-ISOLATED
 private-vlan isolated

! Community VLAN (devices can talk within community)
vlan 62
 name IOT-COMMUNITY
 private-vlan community

! Configure promiscuous port (to router/firewall)
interface GigabitEthernet0/1
 switchport mode private-vlan promiscuous
 switchport private-vlan mapping 60 61,62

! Configure isolated port
interface GigabitEthernet0/10
 switchport mode private-vlan host
 switchport private-vlan host-association 60 61

! Configure community port
interface GigabitEthernet0/20
 switchport mode private-vlan host
 switchport private-vlan host-association 60 62

MAC Address Filtering

! Enable port security
interface GigabitEthernet0/10
 switchport mode access
 switchport access vlan 20
 switchport port-security
 switchport port-security maximum 2
 switchport port-security violation restrict
 switchport port-security mac-address sticky
 switchport port-security aging time 120

DHCP Snooping

! Enable DHCP snooping globally
ip dhcp snooping
ip dhcp snooping vlan 20,60,70,99

! Configure trusted ports (uplinks and DHCP server)
interface GigabitEthernet0/1
 ip dhcp snooping trust

! Untrusted ports (client-facing)
interface range GigabitEthernet0/10-48
 ip dhcp snooping limit rate 10

Dynamic ARP Inspection (DAI)

! Enable DAI
ip arp inspection vlan 20,60,70,99

! Configure trusted ports
interface GigabitEthernet0/1
 ip arp inspection trust

! Configure rate limiting
interface range GigabitEthernet0/10-48
 ip arp inspection limit rate 15

802.1X Port Authentication

! Enable 802.1X globally
aaa new-model
aaa authentication dot1x default group radius
radius server homelab-radius
 address ipv4 10.0.10.5 auth-port 1812
 key your-radius-secret

dot1x system-auth-control

! Configure port for 802.1X
interface GigabitEthernet0/10
 switchport mode access
 authentication port-control auto
 dot1x pae authenticator

Monitoring and Auditing

Network Flow Analysis

Install and Configure ntopng

# Install ntopng
sudo apt-get install ntopng

# Configure
cat > /etc/ntopng/ntopng.conf <<EOF
-i=eth0
-w=3000
--community
--disable-login=1
EOF

sudo systemctl enable --now ntopng

Access at http://YOUR-SERVER-IP:3000

NetFlow Configuration (on router)

! Configure NetFlow export
ip flow-export version 9
ip flow-export destination 10.0.10.100 2055

! Apply to interfaces
interface GigabitEthernet0/0
 ip flow ingress
 ip flow egress

VLAN Traffic Analysis

# Monitor specific VLAN
tcpdump -i eth0.60 -w iot-traffic.pcap

# Analyze with tshark
tshark -r iot-traffic.pcap -q -z conv,ip

# Top talkers
tcpdump -i eth0.60 -nn -c 1000 |   awk '{print $3}' |   sort | uniq -c |   sort -rn | head -20

Firewall Log Analysis

# Monitor pfSense logs
tail -f /var/log/filter.log

# Parse with grep
grep "BLOCK" /var/log/filter.log |   awk '{print $8}' |   sort | uniq -c |   sort -rn

# ELK Stack for log aggregation
docker-compose.yml:
version: '3.8'
services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.11.0
    environment:
      - discovery.type=single-node
    ports:
      - "9200:9200"

  kibana:
    image: docker.elastic.co/kibana/kibana:8.11.0
    ports:
      - "5601:5601"

  logstash:
    image: docker.elastic.co/logstash/logstash:8.11.0
    volumes:
      - ./logstash.conf:/usr/share/logstash/pipeline/logstash.conf
    ports:
      - "5140:5140/udp"

Logstash configuration:

# logstash.conf
input {
  syslog {
    port => 5140
    type => "firewall"
  }
}

filter {
  if [type] == "firewall" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:timestamp} %{HOSTNAME:hostname} %{WORD:action} %{IP:src_ip}:%{NUMBER:src_port} -> %{IP:dst_ip}:%{NUMBER:dst_port}" }
    }
  }
}

output {
  elasticsearch {
    hosts => ["elasticsearch:9200"]
    index => "firewall-%{+YYYY.MM.dd}"
  }
}

IDS/IPS Integration

Suricata Installation

# Install Suricata
sudo apt-get install suricata

# Configure
cat > /etc/suricata/suricata.yaml <<EOF
vars:
  address-groups:
    HOME_NET: "[10.0.0.0/8,192.168.0.0/16]"
    EXTERNAL_NET: "!$HOME_NET"

af-packet:
  - interface: eth0
    threads: 4
    cluster-id: 99

outputs:
  - eve-log:
      enabled: yes
      filetype: regular
      filename: eve.json
      types:
        - alert
        - http
        - dns
        - tls

rule-files:
  - suricata.rules
  - local.rules
EOF

# Update rules
sudo suricata-update

# Start Suricata
sudo systemctl enable --now suricata

Custom Rules for Segmentation

# /etc/suricata/rules/local.rules

# Alert on IoT VLAN trying to access internal networks
alert ip 10.0.60.0/24 any -> 10.0.0.0/8 any (msg:"IoT attempting internal access"; sid:1000001;)

# Alert on guest VLAN internal access
alert ip 10.0.99.0/24 any -> 10.0.0.0/8 any (msg:"Guest attempting internal access"; sid:1000002;)

# Alert on database access from unauthorized VLANs
alert tcp !10.0.40.0/24 any -> 10.0.50.0/24 5432 (msg:"Unauthorized PostgreSQL access"; sid:1000003;)

# Alert on unusual SMB traffic
alert tcp any any -> 10.0.0.0/8 445 (msg:"SMB traffic detected"; sid:1000004;)

Troubleshooting

VLAN Connectivity Issues

# Verify VLAN interface
ip link show eth0.10

# Check VLAN tagging
tcpdump -i eth0 -e vlan 10

# Test inter-VLAN routing
ping -I eth0.10 10.0.20.1

# Trace route between VLANs
traceroute -i eth0.10 10.0.20.100

Firewall Rule Testing

# Test connectivity
nc -zv 10.0.20.100 443

# Check firewall logs
tail -f /var/log/firewall.log

# Packet capture
tcpdump -i any host 10.0.20.100

# Test with hping3
hping3 -S -p 443 10.0.20.100

Performance Monitoring

# Monitor interface statistics
watch -n 1 'ip -s link show'

# Check for errors
ethtool -S eth0 | grep -i error

# Bandwidth monitoring
iftop -i eth0.20

# Connection tracking
conntrack -L | wc -l

Best Practices Summary

Design Principles

  1. Start Simple - Begin with basic segmentation, add complexity as needed
  2. Document Everything - Maintain network diagrams and IP assignments
  3. Default Deny - Block all traffic, explicitly allow what’s needed
  4. Least Privilege - Grant minimum necessary access
  5. Layer Defense - Multiple security layers (firewall, IDS, access control)

Implementation Checklist

  • Define clear VLAN strategy
  • Document IP addressing scheme
  • Configure managed switches with VLANs
  • Implement firewall rules per VLAN
  • Isolate IoT devices
  • Separate guest network
  • Enable logging on all security devices
  • Implement monitoring and alerting
  • Regular security audits
  • Test disaster recovery procedures

Common Mistakes to Avoid

  1. Overly Complex Initial Design - Start simple
  2. Insufficient Documentation - Document changes immediately
  3. Weak Guest Network - Isolate completely from internal
  4. Trusting IoT Devices - Always isolate and restrict
  5. No Monitoring - Implement before issues arise
  6. Static Configuration Only - Plan for growth
  7. Ignoring Performance - Monitor and optimize

Conclusion

Network segmentation is fundamental to homelab security and operations. Proper implementation provides:

  • Strong security posture with defense in depth
  • Containment of security incidents
  • Organized, manageable network architecture
  • Performance optimization through reduced broadcast domains
  • Flexibility for experimentation and growth

Start with basic VLAN segmentation, implement appropriate firewall rules, add monitoring, and gradually introduce advanced features like zero-trust architecture and micro-segmentation as your homelab grows.

Additional Resources