homelab-vlan-segmentation

This skill is a practical guide to segmenting a flat home network into isolated VLANs so that IoT devices, guests, trusted personal machines, and servers cannot freely reach one another. It frames network segmentation as one of the most impactful security upgrades for a home network, solving the problem where a compromised smart TV or camera on a flat subnet can reach a NAS, PCs, and everything else. The guidance is explicitly defensive: it notes that all firewall rules shown add isolation between segments rather than removing existing protections, and advises applying changes in a maintenance window with connectivity verification after each step.

It provides a reusable VLAN design template (trusted, IoT, servers, guest, and management VLANs with subnets and gateways), worked examples of SSID-to-VLAN mapping and switch trunk/access port behavior, and concrete configuration walkthroughs for three platforms: UniFi (networks, WiFi, and traffic rules), pfSense/OPNsense (VLAN interfaces, per-VLAN DHCP, and top-down firewall rules including RFC1918 blocks with DNS and Home Assistant exceptions), and MikroTik (bridge VLAN filtering, tagged trunk ports, and untagged access ports). It also covers troubleshooting inter-VLAN routing and firewall rule ordering.

The target users are homelab operators, self-hosters, and security-conscious home network owners, from beginners who need the concept explained to those configuring trunk ports and firewall rules. Use cases include first-time VLAN setup, isolating IoT devices, creating a guest network that cannot see home devices, and debugging inter-VLAN connectivity issues.