Segmenting Your Home Lab with VLANs: A Practical Guide

If you’re running more than a Pi-hole and a NAS, your home lab deserves proper network segmentation. VLANs let you isolate traffic between devices, keeping your IoT gear away from your workstation, your test servers sandboxed, and your management interfaces locked down.

Why bother with VLANs at home?

Most home networks are flat: everything talks to everything. That’s fine for a family of phones and laptops, but once you start adding servers, cameras, and experimental containers, a flat network becomes a liability.

VLANs give you:

• Isolation: compromised IoT devices can’t sniff traffic from your workstation.
• Organization: group devices logically instead of physically.
• Traffic control: apply firewall rules between segments.

What you need

• A managed switch that supports 802.1Q VLAN tagging (TP-Link TL-SG108E works great for under $30)
• A router/firewall that supports VLANs (pfSense, OPNsense, or MikroTik)
• A bit of patience for the initial setup

Basic VLAN layout

Here’s a starting point that works well for most home labs:

VLAN ID	Name	Purpose
10	Management	Router, switch, AP management
20	Trusted	Workstations, phones
30	Lab	Test VMs, containers
40	IoT	Cameras, smart devices

Setting it up in pfSense

1. Navigate to Interfaces -> Assignments -> VLANs
2. Create each VLAN on your LAN parent interface
3. Assign each VLAN as a new interface
4. Configure DHCP for each VLAN subnet
5. Set up firewall rules. Start with “block all inter-VLAN” and whitelist what you need.

Key firewall rules

The golden rule: deny by default between VLANs, then allow specific traffic. Your IoT network should probably never initiate connections to your trusted network. Your lab network might need access to the internet but not to management.

# Example pfSense rule logic
IoT -> Trusted: BLOCK
IoT -> Internet: ALLOW
Lab -> Internet: ALLOW
Lab -> Management: BLOCK
Trusted -> Lab: ALLOW (for SSH/management)

Common gotchas

• DNS resolution across VLANs: make sure your DNS server is accessible from all VLANs, or run per-VLAN DNS.
• mDNS/Bonjour: services like AirPlay won’t work across VLANs without an mDNS reflector (Avahi works).
• Switch trunk ports: your uplink to the router must be a trunk port carrying all VLANs.

VLANs take maybe an hour to set up properly, but they’ll save you from headaches down the road, especially if you’re experimenting with services exposed to the internet.