VLANs for Homelabs: Network Segmentation Guide

Introduction

Virtual Local Area Networks (VLANs) are the cornerstone of modern network design, allowing you to segment a single physical network into multiple isolated logical networks. For homelab enthusiasts, VLANs enable professional-grade network architecture: isolate IoT devices from personal computers, separate guest WiFi from internal services, create dedicated management networks, and implement proper security boundaries - all using existing hardware. This comprehensive guide will transform your flat network into a secure, organized, multi-tier infrastructure.

What You’ll Learn

Understanding VLAN fundamentals and 802.1Q tagging
Planning VLAN architecture for homelabs
Configuring managed switches for VLAN trunking
Setting up VLANs in pfSense/OPNsense
Implementing inter-VLAN routing
Creating isolated IoT and guest networks
VLAN security best practices
Troubleshooting VLAN connectivity
Advanced VLAN features (QinQ, Private VLANs)
Integration with virtualization platforms

Why VLANs Matter

Security Through Segmentation: Isolate untrusted devices (IoT gadgets, guest users) from sensitive systems (NAS, servers, workstations). A compromised smart bulb cannot access your personal files.

Performance Optimization: Reduce broadcast domains, minimize network congestion, and improve overall performance by logically separating traffic types.

Simplified Management: Organize devices by function rather than physical location. Move a device to a different VLAN with configuration changes, not cable swaps.

Professional Skills: Enterprise networks universally use VLANs. Learning them in your homelab builds career-relevant expertise.

Cost Efficiency: Achieve network segmentation without buying multiple physical switches or routers. One managed switch can host dozens of VLANs.

Prerequisites

Hardware Requirements:

Managed switch with VLAN support (802.1Q)
- Entry: TP-Link TL-SG108E (under $40)
- Mid-range: Ubiquiti UniFi switches
- Enterprise: Cisco, HPE, Aruba
Router/firewall capable of VLAN tagging (pfSense, OPNsense, or VLAN-capable router)
Optional: Wireless access point with VLAN support for WiFi segmentation

Software Requirements:

Router OS supporting VLANs (pfSense, OPNsense, OpenWrt, VyOS)
Switch management interface access
Network planning tools (pen and paper work great!)

Knowledge Requirements:

Basic networking concepts (IP addressing, subnets, gateways)
Understanding of switches and routers
Comfort with web-based configuration interfaces
Basic command line helpful but not required

Time Commitment:

Planning: 30-60 minutes (crucial step)
Implementation: 2-4 hours for basic setup
Testing and refinement: 1-2 hours
Ongoing management: Minimal once stable

VLAN Fundamentals

What is a VLAN?

A VLAN is a logical broadcast domain that can span multiple physical switches. Devices on the same VLAN communicate as if connected to the same physical switch, even if they’re on different switches or different floors.

Traditional Network (No VLANs):

All devices in one broadcast domain
[Computer] [IoT] [Server] [Guest]
            |       |      /
            |       |     /
            |       |    /
        [  Single Switch  ]
             |
        [  Router  ]

Problem: All devices can see each other’s traffic. Security risk.

VLAN-Segmented Network:

[Computer]  [IoT]  [Server]  [Guest]
   VLAN10  VLAN20  VLAN30   VLAN40
            |       |      /
            |       |     /
            |       |    /
    [  Managed Switch  ]
      (VLAN Trunk)
             |
        [  Router  ]
    (Inter-VLAN Routing)

Benefit: Isolated broadcast domains, controlled inter-VLAN communication.

802.1Q Tagging

How VLANs Work:

When a device sends a frame to a switch port configured for a specific VLAN, the switch adds a 4-byte VLAN tag to the Ethernet frame.
This tag contains the VLAN ID (VID), identifying which VLAN the frame belongs to.
Other switches along the path read this tag and forward the frame only to ports assigned to that VLAN.
When the frame reaches its destination, the tag is removed (unless the destination port is a trunk).

Frame Structure:

Standard Ethernet Frame:
[Destination MAC][Source MAC][EtherType][Data][FCS]

802.1Q Tagged Frame:
[Destination MAC][Source MAC][802.1Q Tag][EtherType][Data][FCS]

802.1Q Tag (4 bytes):
  - TPID (Tag Protocol Identifier): 0x8100
  - PCP (Priority Code Point): 3 bits (QoS)
  - DEI (Drop Eligible Indicator): 1 bit
  - VID (VLAN Identifier): 12 bits (4096 possible VLANs)

VLAN ID Range:

0: Reserved (indicates priority tagging)
1: Default VLAN (native VLAN on many switches)
2-1001: Normal VLANs (standard range)
1002-1005: Reserved for legacy protocols
1006-4094: Extended VLANs (requires more advanced switches)

Port Types

Access Port (Untagged):

Connects to end devices (computers, phones, cameras)
Carries traffic for ONE VLAN only
Strips VLAN tag before sending to device
Adds VLAN tag when receiving from device
Device is unaware of VLANs

Example:

Computer (no VLAN awareness)
    |
Access Port (VLAN 10)
    |
Switch adds VLAN 10 tag to all frames from this port

Trunk Port (Tagged):

Connects switches to switches or switches to routers
Carries traffic for MULTIPLE VLANs
Preserves VLAN tags across the link
Native VLAN (untagged): One VLAN can be untagged on trunk

Example:

Switch A                    Switch B
[Trunk Port] ----------- [Trunk Port]
VLANs 10,20,30          VLANs 10,20,30
All tags preserved

Hybrid Port:

Some vendors support hybrid ports
Carries both tagged and untagged VLANs
Less common, vendor-specific

Planning Your VLAN Architecture

Planning is crucial. A poorly planned VLAN structure creates headaches. A well-planned one provides security and clarity.

Sample Homelab VLAN Design

VLAN 1 - Native/Unused (192.168.1.0/24)

Purpose: Switch management only
Reason: Never use VLAN 1 for production traffic (security best practice)

VLAN 10 - Trusted/Workstations (192.168.10.0/24)

Purpose: Personal computers, laptops, trusted devices
Access: Full internet, access to servers (controlled by firewall rules)
Devices: Workstations, laptops, phones

VLAN 20 - Servers (192.168.20.0/24)

Purpose: Homelab servers (Proxmox, Docker hosts, NAS)
Access: Internet for updates, accessible from Trusted VLAN
Devices: Proxmox hosts, NAS, dedicated servers

VLAN 30 - IoT (192.168.30.0/24)

Purpose: Smart home devices, cameras, untrusted gadgets
Access: Internet only (no access to other VLANs)
Devices: Smart lights, thermostats, security cameras, voice assistants

VLAN 40 - Guest (192.168.40.0/24)

Purpose: Visitor WiFi
Access: Internet only, isolated from all other networks
Devices: Visitors’ phones, tablets, laptops

VLAN 50 - Management (192.168.50.0/24)

Purpose: Device management interfaces (iDRAC, iLOM, switch management)
Access: Accessible only from admin workstation
Devices: Server BMC/IPMI, switch management IPs

VLAN 99 - Lab/Testing (192.168.99.0/24)

Purpose: Isolated testing environment
Access: No access to production VLANs
Devices: Test VMs, experimental setups

VLAN Numbering Best Practices

Use Meaningful Numbers:

10-19: User networks
20-29: Server networks
30-39: IoT and smart home
40-49: Guest networks
50-59: Management
60-69: Security (cameras, access control)
70-79: VoIP
80-89: Media/streaming
90-99: Lab/testing
100+: Reserved for future expansion

Document Everything:

Create a VLAN table:

VLAN ID	Name	Subnet	Gateway	DHCP Range	Purpose	Internet Access
1	Native	192.168.1.0/24	192.168.1.1	None	Management	Yes
10	Trusted	192.168.10.0/24	192.168.10.1	.100-.200	Workstations	Yes (full)
20	Servers	192.168.20.0/24	192.168.20.1	.100-.150	Servers	Yes (controlled)
30	IoT	192.168.30.0/24	192.168.30.1	.100-.250	Smart devices	Internet only
40	Guest	192.168.40.0/24	192.168.40.1	.100-.200	Guest WiFi	Internet only
50	Management	192.168.50.0/24	192.168.50.1	None (static)	IPMI/BMC	No

Security Zone Design

Trust Levels:

Highest Trust: Management VLAN
  ↓ One-way access
High Trust: Trusted/Workstations VLAN
  ↓ Controlled access
Medium Trust: Servers VLAN
  ↓ No lateral access
Low Trust: IoT VLAN
  ↓ No lateral access
Zero Trust: Guest VLAN

Firewall Rule Philosophy:

Default deny between VLANs
Explicitly allow required access
Log denied traffic for troubleshooting

Switch Configuration

Example: TP-Link Managed Switch

Access Switch Interface:

Connect computer to switch
Set static IP: 192.168.0.10/24 (TP-Link default: 192.168.0.1)
Browse to http://192.168.0.1
Login (default: admin/admin)

Step 1: Create VLANs

VLAN → 802.1Q VLAN → VLAN Config

Create VLANs:
  VLAN ID: 10
  VLAN Name: Trusted
  Create

  VLAN ID: 20
  VLAN Name: Servers
  Create

  VLAN ID: 30
  VLAN Name: IoT
  Create

  VLAN ID: 40
  VLAN Name: Guest
  Create

  VLAN ID: 50
  VLAN Name: Management
  Create

Step 2: Assign Ports to VLANs

Port Configuration Strategy:

Port 1-2: Trunk ports (to router/firewall)
Port 3-10: Access ports for devices
Port 11-16: Access ports for WiFi APs

Configure Trunk Ports (to Router):

VLAN → 802.1Q VLAN → Port Config

Port 1-2:
  VLAN Mode: Trunk
  Native VLAN: 1
  Allowed VLANs: 1,10,20,30,40,50

Apply

Configure Access Ports:

Port 3 (Workstation):
  VLAN Mode: Access
  PVID: 10 (assigns to VLAN 10)

Port 4 (Server):
  VLAN Mode: Access
  PVID: 20

Port 5 (IoT Device):
  VLAN Mode: Access
  PVID: 30

Port 6 (Guest WiFi AP):
  VLAN Mode: Trunk
  Native VLAN: 40
  Allowed VLANs: 40 (if AP needs only guest)
  Or Allowed VLANs: 10,40 (if AP serves multiple SSIDs)

Apply

Step 3: Configure Switch Management IP

Network → IP Configuration

IP Address: 192.168.50.2
Subnet Mask: 255.255.255.0
Default Gateway: 192.168.50.1
Management VLAN: 50

Apply

Step 4: Save Configuration

System Tools → Save Config

Save Configuration to Flash

Example: Cisco Switch Configuration

For those with Cisco equipment:

! Enter configuration mode
configure terminal

! Create VLANs
vlan 10
 name Trusted
vlan 20
 name Servers
vlan 30
 name IoT
vlan 40
 name Guest
vlan 50
 name Management
exit

! Configure trunk port (to router)
interface GigabitEthernet0/1
 description Trunk to pfSense
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport trunk allowed vlan 1,10,20,30,40,50
 switchport trunk native vlan 1
exit

! Configure access port examples
interface GigabitEthernet0/2
 description Workstation
 switchport mode access
 switchport access vlan 10
 spanning-tree portfast
exit

interface GigabitEthernet0/3
 description IoT Device
 switchport mode access
 switchport access vlan 30
 spanning-tree portfast
exit

! Configure management interface
interface vlan 50
 ip address 192.168.50.2 255.255.255.0
 no shutdown
exit

ip default-gateway 192.168.50.1

! Save configuration
write memory

Example: UniFi Switch Configuration

Via UniFi Controller:

Create Networks (VLANs)

Settings → Networks → Create New Network

Network Name: Trusted
VLAN ID: 10
Gateway/Subnet: 192.168.10.1/24
DHCP: Enabled
DHCP Range: 192.168.10.100 - 192.168.10.200

Repeat for other VLANs

Create Port Profiles

Settings → Profiles → Switch Ports → Create New

Profile Name: Workstation
Native Network: Trusted (VLAN 10)
Tagged Networks: None

Profile Name: Trunk to Router
Native Network: Default (VLAN 1)
Tagged Networks: Trusted, Servers, IoT, Guest, Management

Assign Profiles to Ports

Devices → Select Switch → Ports

Port 1-2: Trunk to Router
Port 3-10: Workstation
Port 11: IoT

Router/Firewall Configuration (pfSense)

Creating VLAN Interfaces

Step 1: Create VLAN Tags

Interfaces → Assignments → VLANs → Add

Parent Interface: em0 (your LAN interface)
VLAN Tag: 10
VLAN Priority: 0
Description: Trusted

Save and repeat for VLANs 20, 30, 40, 50

Step 2: Assign VLAN Interfaces

Interfaces → Assignments

Available network ports:
  VLAN 10 on em0 (Trusted) → Add
  VLAN 20 on em0 (Servers) → Add
  VLAN 30 on em0 (IoT) → Add
  VLAN 40 on em0 (Guest) → Add
  VLAN 50 on em0 (Management) → Add

Save

Interfaces now appear as OPT1, OPT2, OPT3, etc.

Step 3: Enable and Configure Each Interface

Interfaces → OPT1 (rename to TRUSTED)

Enable: Checked
Description: Trusted
IPv4 Configuration Type: Static IPv4
IPv4 Address: 192.168.10.1 / 24
Reserved Networks: Uncheck "Block private networks"

Save and Apply

Repeat for other VLANs:
  OPT2 → SERVERS → 192.168.20.1/24
  OPT3 → IOT → 192.168.30.1/24
  OPT4 → GUEST → 192.168.40.1/24
  OPT5 → MANAGEMENT → 192.168.50.1/24

Step 4: Enable DHCP on VLANs

Services → DHCP Server → TRUSTED

Enable: Checked
Range: 192.168.10.100 to 192.168.10.200
DNS Servers: 192.168.10.1 (or 1.1.1.1)
Gateway: 192.168.10.1

Save and repeat for other VLANs

Inter-VLAN Routing and Firewall Rules

Default Deny Strategy

By default, pfSense blocks all traffic between interfaces. You must explicitly allow desired traffic.

Philosophy:

1. Deny all (implicit default)
2. Allow specific required access
3. Log everything for troubleshooting

Example Firewall Rules

TRUSTED VLAN Rules (Full Access)

Firewall → Rules → TRUSTED → Add

1. Allow to Internet
   Action: Pass
   Protocol: Any
   Source: TRUSTED net
   Destination: Any
   Description: Allow Trusted to Internet

2. Allow to Servers
   Action: Pass
   Protocol: Any
   Source: TRUSTED net
   Destination: SERVERS net
   Description: Allow Trusted to access Servers

3. Allow DNS to pfSense
   Action: Pass
   Protocol: UDP
   Source: TRUSTED net
   Destination: TRUSTED address
   Destination Port: 53
   Description: Allow DNS queries to pfSense

Save and Apply

SERVERS VLAN Rules (Controlled Access)

Firewall → Rules → SERVERS → Add

1. Allow Internet for Updates
   Action: Pass
   Protocol: TCP
   Source: SERVERS net
   Destination: Any
   Destination Port: 80, 443
   Description: Allow HTTPS for updates

2. Block to TRUSTED (prevent lateral movement)
   Action: Block
   Protocol: Any
   Source: SERVERS net
   Destination: TRUSTED net
   Description: Block servers from initiating to Trusted
   Position: Place ABOVE any allow rules

3. Allow DNS
   Action: Pass
   Protocol: UDP
   Source: SERVERS net
   Destination: SERVERS address
   Destination Port: 53

Save and Apply

IOT VLAN Rules (Internet Only)

Firewall → Rules → IOT → Add

1. Block RFC1918 Private Networks
   Action: Block
   Protocol: Any
   Source: IOT net
   Destination: RFC1918 (create alias)
   Description: Block IoT from accessing internal networks
   Log: Checked

Create RFC1918 Alias:
  Firewall → Aliases → IP → Add
  Name: RFC1918
  Type: Network(s)
  Networks:
    10.0.0.0/8
    172.16.0.0/12
    192.168.0.0/16
  Description: Private address space

2. Allow Internet
   Action: Pass
   Protocol: Any
   Source: IOT net
   Destination: !RFC1918 (inverted - NOT private)
   Description: Allow IoT to Internet only

3. Allow DNS to pfSense (required)
   Action: Pass
   Protocol: UDP
   Source: IOT net
   Destination: IOT address
   Destination Port: 53
   Position: Place ABOVE block rule

Save and Apply

GUEST VLAN Rules (Internet Only, Strict)

Firewall → Rules → GUEST → Add

1. Block All Private Networks
   Action: Block
   Protocol: Any
   Source: GUEST net
   Destination: RFC1918
   Description: Block Guest from internal networks
   Log: Checked

2. Block pfSense Management
   Action: Block
   Protocol: Any
   Source: GUEST net
   Destination: This Firewall
   Description: Block access to pfSense GUI/SSH
   Log: Checked

3. Allow DNS (to public servers only)
   Action: Pass
   Protocol: UDP
   Source: GUEST net
   Destination: !RFC1918
   Destination Port: 53
   Description: Allow DNS to public servers

4. Allow Internet
   Action: Pass
   Protocol: Any
   Source: GUEST net
   Destination: !RFC1918
   Description: Allow Guest to Internet

Save and Apply

MANAGEMENT VLAN Rules (Admin Access Only)

Firewall → Rules → MANAGEMENT → Add

1. Block Internet
   Action: Block
   Protocol: Any
   Source: MANAGEMENT net
   Destination: !RFC1918
   Description: Block Management VLAN from Internet

2. Allow Admin Access to All VLANs
   Action: Pass
   Protocol: Any
   Source: 192.168.50.10/32 (admin workstation)
   Destination: Any
   Description: Allow admin workstation full access

3. Block All Other Management Devices
   Action: Block
   Protocol: Any
   Source: MANAGEMENT net
   Destination: Any
   Description: Default deny management devices

Save and Apply

Verification and Testing

Test Connectivity:

# From Trusted VLAN device (192.168.10.50)

# Test Internet access
ping 8.8.8.8
ping google.com

# Test access to Server VLAN (should work)
ping 192.168.20.10

# Test access to IoT VLAN (should fail - blocked)
ping 192.168.30.10

# From IoT VLAN device (192.168.30.15)

# Test Internet (should work)
ping 8.8.8.8

# Test access to Trusted VLAN (should fail)
ping 192.168.10.50

# Test access to Server VLAN (should fail)
ping 192.168.20.10

Monitor Firewall Logs:

Status → System Logs → Firewall

Enable Auto Refresh
Filter by interface to troubleshoot specific VLANs
Look for blocked traffic to understand what's being denied

WiFi VLAN Configuration

UniFi Access Point Setup

Controller Configuration:

Settings → Wireless Networks

1. Trusted WiFi (for family devices)
   Name: HomeNetwork
   Security: WPA2/WPA3 Enterprise or Personal
   Password: (strong password)
   Network: Trusted (VLAN 10)

2. IoT WiFi (for smart devices)
   Name: SmartHome
   Security: WPA2 Personal
   Password: (different password)
   Network: IoT (VLAN 30)
   Client Device Isolation: Enabled
   Multicast and Broadcast Control: Enabled

3. Guest WiFi
   Name: GuestNetwork
   Security: WPA2 Personal
   Password: (simple password to share)
   Network: Guest (VLAN 40)
   Guest Policy: Enabled
   Client Device Isolation: Enabled

Access Point Assignment:

Devices → Access Points → Select AP

Port Configuration:
  Ensure connected to switch port configured as trunk
  Or if AP uplink is trunk, VLAN tagging handled automatically

TP-Link EAP Access Points

Via Omada Controller:

Wireless → Wireless Networks → Create

SSID: HomeNetwork
Network: Select VLAN 10
Security: WPA2-PSK
Password: (secure)

SSID: SmartHome
Network: Select VLAN 30
Security: WPA2-PSK
Client Isolation: Enabled

SSID: GuestNetwork
Network: Select VLAN 40
Security: WPA2-PSK
Guest Network: Enabled

OpenWrt Access Point

For DIY enthusiasts:

Network → Wireless

Add new SSID:
  ESSID: HomeNetwork
  Network: Create new interface
    Name: trusted
    Protocol: Static address
    IPv4 address: 192.168.10.2
    VLAN: 10

Advanced VLAN Techniques

Private VLANs (PVLANs)

Isolate devices within the same VLAN (useful for IoT).

Types:

Promiscuous: Can communicate with all ports (gateway)
Isolated: Can only talk to promiscuous ports
Community: Can talk to promiscuous and same community

Use Case: Prevent IoT devices from talking to each other, only to gateway.

Configuration (Enterprise Switches):

vlan 30
 name IoT
 private-vlan primary
 private-vlan association 31

vlan 31
 name IoT-Isolated
 private-vlan isolated

interface GigabitEthernet0/1
 description Gateway
 switchport private-vlan mapping 30 31
 switchport mode private-vlan promiscuous

interface range GigabitEthernet0/2-10
 description IoT Devices
 switchport mode private-vlan host
 switchport private-vlan host-association 30 31

QinQ (VLAN Stacking)

Run VLANs over VLANs. Advanced use case for service providers or complex lab setups.

Customer VLAN 10 → Encapsulated in Provider VLAN 100
[Device VLAN 10] → [Switch adds VLAN 100] → [Transport] → [Switch removes VLAN 100] → [Device VLAN 10]

Dynamic VLANs (802.1X)

Assign VLAN based on authentication (RADIUS).

Setup:

RADIUS server (FreeRADIUS)
Switch configured for 802.1X
User/device authentication assigns VLAN dynamically

Use Case: Same port assigns different VLAN based on who/what connects.

Troubleshooting VLANs

Connectivity Issues

Problem: Device cannot get IP address

Check:
1. Is port assigned to correct VLAN?
   - Verify switch port PVID matches intended VLAN
2. Is DHCP enabled on router for that VLAN?
   - pfSense: Services → DHCP Server → (VLAN)
3. Is firewall blocking DHCP?
   - Allow UDP 67-68 from VLAN subnet to router
4. Check DHCP logs:
   - Status → System Logs → DHCP

Problem: Can access internet but not other VLANs

Expected behavior if firewall blocks inter-VLAN traffic.

To allow access:
1. Create firewall rule on source VLAN
   - Firewall → Rules → (Source VLAN) → Add
   - Allow to destination VLAN
2. Check rule order (first match wins)
3. Verify logging to see if traffic is being blocked

Problem: VLAN tagging not working

Verify:
1. Switch port mode:
   - Trunk ports: Must be set to "Trunk" or "Tagged"
   - Access ports: Must be set to "Access" or "Untagged"
2. VLAN is created on switch
3. VLAN is allowed on trunk port
4. Router has VLAN interface configured
5. Check native VLAN mismatch (common issue)

Problem: Native VLAN mismatch

Symptoms:
  - Untagged traffic not passing
  - Switch logs show VLAN mismatch errors

Fix:
  - Ensure both ends of trunk have same native VLAN
  - Typically VLAN 1 or VLAN 99 (management)

pfSense:
  Interfaces → VLANs
  Parent interface should NOT tag native VLAN

Switch:
  Set native VLAN on trunk port

Diagnostic Tools

tcpdump on pfSense:

# SSH to pfSense
# Capture VLAN 10 traffic on em0
tcpdump -i em0.10 -n

# Capture DHCP traffic
tcpdump -i em0.10 -n port 67 or port 68

# Capture specific device
tcpdump -i em0.10 -n host 192.168.10.50

Check VLAN interfaces:

# pfSense shell
ifconfig

# Should show em0.10, em0.20, etc.
# Look for:
#   vlan: 10 vlanpcp: 0 parent interface: em0
#   inet 192.168.10.1 netmask 0xffffff00

Test from pfSense:

Diagnostics → Ping

Host: 192.168.10.50
Source address: 192.168.10.1 (VLAN interface)

Should work if device is online

Switch diagnostics:

# Show VLAN configuration
show vlan (Cisco)
display vlan (Huawei)

# Show port status
show interfaces status
show interfaces trunk

# Show MAC address table per VLAN
show mac address-table vlan 10

Security Best Practices

VLAN Hopping Prevention

Attack Vector: Attacker sends double-tagged frames to jump VLANs.

Mitigation:

Never use VLAN 1 for production traffic

Disable VLAN 1 on all trunk ports
Use VLAN 99 or other for native VLAN

Explicitly disable DTP (Dynamic Trunking Protocol)

interface GigabitEthernet0/1
 switchport mode access
 switchport nonegotiate

Use access ports where possible

Only use trunk ports when necessary (switch-to-switch, switch-to-router)
Never trunk to end devices

Enable BPDU Guard and Root Guard

spanning-tree portfast bpduguard default

Least Privilege Access

Firewall Rules:

Start with deny all (default)
Add minimum necessary permissions
Review quarterly
Remove unused rules

Management Access:

Restrict management VLAN to specific workstations
Use strong passwords
Enable 2FA where possible
Disable unused services (Telnet, HTTP - use SSH, HTTPS)

Monitoring and Logging

Enable logging on deny rules:

Firewall → Rules → (Any VLAN) → Edit Block Rule
Advanced Options → Log: Checked

View logs:
Status → System Logs → Firewall
Filter by interface, source, destination

Regular audits:

# Script to check firewall rules
# Run monthly, review for unused rules

# Check for overly permissive rules
grep "destination: any" /cf/conf/config.xml

# Review blocked traffic
cat /var/log/filter.log | grep BLOCK | awk '{print $10}' | sort | uniq -c | sort -rn | head -20

Integration with Virtualization

Proxmox VLAN Configuration

Create Linux Bridge with VLAN Awareness:

Proxmox Node → Network → Create Linux Bridge

Name: vmbr0
IPv4/CIDR: 192.168.10.2/24 (Proxmox management IP in Trusted VLAN)
Gateway: 192.168.10.1
VLAN Aware: Yes
Comment: VLAN-aware bridge

Apply

Assign VLANs to VMs:

VM → Hardware → Network Device → Edit

Bridge: vmbr0
VLAN Tag: 10 (for Trusted VLAN)

For VM in Servers VLAN:
  VLAN Tag: 20

Multiple VLANs in One VM (for router VMs like pfSense):

Create multiple network devices:
  net0: vmbr0, VLAN Tag: 10 (Trusted)
  net1: vmbr0, VLAN Tag: 20 (Servers)
  net2: vmbr0, VLAN Tag: 30 (IoT)

VMware ESXi VLAN Setup

Create Port Groups for each VLAN:

Networking → Virtual Switches → vSwitch0 → Port Groups → Add

Name: VLAN10-Trusted
VLAN ID: 10

Name: VLAN20-Servers
VLAN ID: 20

Name: VLAN30-IoT
VLAN ID: 30

Assign to VMs:

VM → Edit Settings → Network Adapter
Network Label: VLAN10-Trusted

Docker VLAN Networking

Create VLAN network in Docker:

# Create macvlan network for VLAN 20
docker network create -d macvlan   --subnet=192.168.20.0/24   --gateway=192.168.20.1   -o parent=eth0.20   vlan20_net

# Deploy container on VLAN 20
docker run -d   --name nginx-server   --network vlan20_net   --ip 192.168.20.50   nginx

Docker Compose example:

version: '3.8'

networks:
  vlan20:
    driver: macvlan
    driver_opts:
      parent: eth0.20
    ipam:
      config:
        - subnet: 192.168.20.0/24
          gateway: 192.168.20.1

services:
  webserver:
    image: nginx
    networks:
      vlan20:
        ipv4_address: 192.168.20.50

Performance Optimization

Jumbo Frames

Increase MTU for better throughput on storage networks.

Enable on interfaces:

pfSense:
  Interfaces → SERVERS → MTU: 9000

Switch:
  System → Jumbo Frame: Enable (9000 bytes)

End devices:
  Configure network adapter MTU: 9000

Test:

# Ping with large packet
ping -s 8972 -M do 192.168.20.10

# Should succeed if jumbo frames working
# If fails, intermediate device doesn't support

Spanning Tree Optimization

Enable PortFast on access ports:

interface range GigabitEthernet0/2-24
 spanning-tree portfast

Benefit: Devices connect immediately instead of waiting 30 seconds for STP convergence.

Enable BPDU Guard:

spanning-tree portfast bpduguard default

Benefit: Prevents loops if someone accidentally connects switch to access port.

Conclusion

VLANs transform chaotic flat networks into organized, secure infrastructures. Through proper segmentation, you’ve isolated untrusted devices, created guest networks, and implemented professional-grade security - all fundamental skills for any serious homelab enthusiast or aspiring network engineer.

Key Takeaways

Security through segmentation: IoT devices can never access your personal data
Organizational clarity: Devices grouped by function, not location
Professional skills: Enterprise-relevant experience in your own lab
Scalability: Add VLANs as your homelab grows
Cost-effective: One switch, dozens of logical networks

Next Steps

Immediate Actions:

Implement basic VLAN design (Trusted, IoT, Guest)
Configure managed switch
Set up pfSense VLAN interfaces
Test connectivity and isolation

Advanced Projects:

Add VLAN-aware WiFi with multiple SSIDs
Implement dynamic VLAN assignment (802.1X)
Create dedicated VLANs for specific services (VoIP, cameras)
Set up monitoring for VLAN traffic patterns

Additional Resources

IEEE 802.1Q Standard: Official VLAN specification
r/homelab: Active community with VLAN discussions
pfSense Documentation: https://docs.netgate.com/pfsense/
Cisco VLAN Configuration Guide: Excellent even for non-Cisco switches
UniFi Community: Great for UniFi-specific VLAN setups

Document Version: 1.0 Last Updated: December 16, 2025 Difficulty: Intermediate Estimated Setup Time: 2-4 hours for basic implementation Maintenance: Minimal once configured properly