Home Network VLANs

Why Segment Your Network?

Most home networks are "flat": every device can see and communicate with every other device. This is a security disaster.

The problem:

• Smart TVs, cameras, and IoT devices often have poor security
• Manufacturers stop patching devices after a few years
• A compromised IoT device can attack everything on your network
• Data-harvesting devices can see traffic from your computers

The solution: Network segmentation. Put devices in separate zones with firewall rules controlling what can talk to what.

Example Attack Scenario

Without segmentation:

1. Attacker compromises your smart light bulb via known vulnerability
2. From the bulb, they scan your network
3. They find your NAS with personal files
4. They exfiltrate data or install ransomware

With segmentation:

1. Attacker compromises your smart light bulb
2. Firewall blocks the bulb from reaching your trusted network
3. Attack contained to IoT segment

Network Design

Recommended Segments

IP Addressing Scheme

Hardware Requirements

Router/Firewall Options

Managed Switch

You need a switch that supports 802.1Q VLANs. Unmanaged switches won't work.

Budget options:

• TP-Link TL-SG108E (~$30)
• Netgear GS308E (~$40)

Better options:

• UniFi Switch Lite 8 PoE (~$110)
• Netgear GS110TP (~$90)

Wireless Access Points

Your AP needs to support multiple SSIDs with VLAN tagging:

• UniFi AP (any model)
• TP-Link Omada series
• Ruckus (enterprise, expensive)

Consumer routers with DD-WRT/OpenWrt can also work.

Switch Configuration

Port Types

Access ports: Connect to end devices (computers, IoT). Carry only one VLAN, untagged.

Trunk ports: Connect switches together or to router. Carry multiple VLANs, tagged.

Example: TP-Link TL-SG108E

In the switch admin panel (usually 192.168.0.1):

1. Go to VLAN > 802.1Q VLAN
2. Enable 802.1Q VLAN
3. Create VLANs 10, 20, 30, 40
4. Configure ports:
   • Port 1 (to router): Tagged for all VLANs (trunk)
   • Port 2-3: Untagged VLAN 10 (trusted devices)
   • Port 4-5: Untagged VLAN 20 (IoT)
   • Port 6-7: Untagged VLAN 30 (security)
   • Port 8: Tagged all VLANs (to WiFi AP)
5. Set PVID (port VLAN ID) for each access port

Router/Firewall Configuration

pfSense/OPNsense Example

Create VLAN Interfaces

1. Interfaces > Assignments > VLANs
2. Add VLAN: Parent = LAN interface, Tag = 10
3. Repeat for VLANs 20, 30, 40
4. Interfaces > Assignments: Add each VLAN as new interface
5. Configure each interface:
   • Enable
   • Set static IP (e.g., 192.168.10.1 for VLAN 10)
   • Set description

Configure DHCP

Services > DHCP Server: Enable for each VLAN with appropriate range.

Firewall Rules

Firewall > Rules: Create rules for each VLAN.

VLAN 10 (Trusted):

# Allow all outbound
Pass IPv4 * VLAN10_net * * * *
            

VLAN 20 (IoT):

# Block access to other VLANs
Block IPv4 * VLAN20_net VLAN10_net * * *
Block IPv4 * VLAN20_net VLAN30_net * * *
Block IPv4 * VLAN20_net VLAN40_net * * *

# Allow internet
Pass IPv4 * VLAN20_net * * * *
            

VLAN 30 (Security):

# Block internet (cameras shouldn't phone home)
Block IPv4 * VLAN30_net * * * *

# Allow access from trusted (to view cameras)
# (Configured on VLAN10 rules)
            

VLAN 40 (Guest):

# Block all RFC1918 (private networks)
Block IPv4 * VLAN40_net 10.0.0.0/8 * * *
Block IPv4 * VLAN40_net 172.16.0.0/12 * * *
Block IPv4 * VLAN40_net 192.168.0.0/16 * * *

# Allow internet
Pass IPv4 * VLAN40_net * * * *
            

WiFi Configuration

Create separate SSIDs for each VLAN:

Guest network settings:

• Enable client isolation (guests can't see each other)
• Enable bandwidth limits
• Consider captive portal

Special Cases

Smart Home Control (Phone to IoT)

Problem: Your phone is on Trusted, but needs to control IoT devices.

Solution 1: Allow established connections

IoT devices can't initiate connections to Trusted, but Trusted can reach IoT. Most control apps work this way.

Solution 2: Hub-based control

Use a hub (Home Assistant, SmartThings) on the IoT network. Access the hub's web interface from Trusted.

Chromecast/AirPlay

Casting requires mDNS/Bonjour to work across VLANs.

Solution: Enable mDNS reflection/proxy in your router. In pfSense: Services > Avahi.

Printers

Put printers on their own VLAN or Trusted. Create specific firewall rules allowing print traffic from other VLANs.

Security Cameras

Cameras on VLAN 30 need to be viewable from VLAN 10 (Trusted).

Firewall rule on VLAN 10:

# Allow Trusted to reach camera NVR
Pass IPv4 * VLAN10_net VLAN30_net 80,443,554 tcp *
            

Testing Your Setup

Verify Isolation

From an IoT device, try to ping a Trusted device:

ping 192.168.10.50
# Should fail/timeout
            

From Trusted, ping IoT device:

ping 192.168.20.50
# Should succeed (if allowed by rules)
            

Network Scanning

From each VLAN, run a scan to see what's visible:

# Using nmap
nmap -sn 192.168.10.0/24
nmap -sn 192.168.20.0/24
            

IoT devices should only see other IoT devices.

Internet Access

Verify each VLAN has appropriate internet access:

ping 8.8.8.8
curl https://example.com
            

Ongoing Monitoring

• Check firewall logs for blocked cross-VLAN attempts
• A spike in blocked traffic from IoT could indicate compromise
• Review DHCP leases to spot new devices
• Consider adding Pi-hole for DNS-level visibility

The Bottom Line

Network segmentation is the single most effective way to protect your home network from IoT-based attacks. Once configured, it requires minimal maintenance and provides defense-in-depth that no amount of device-level security can match.

The investment is modest: a managed switch ($30-100) and a capable router/firewall (free with pfSense, or $200+ for turnkey solutions). The setup takes a few hours. The protection is permanent.

Start simple: Trusted and IoT networks. Add Guest and Security segments as needed. Test thoroughly before relying on it. And remember: VLANs build the walls, but firewall rules control the doors.

References

1. Bitdefender: Securing Your Smart Home with Network Segmentation
2. Virtualization Howto: Home Lab Networking 101
3. Mastering Network Segmentation for Home Assistant and IoT
4. Firewalla: Network Segmentation Guide
5. How-To Geek: Setting Up VLANs for Smart Home

Related

• Raspberry Pi Privacy Server: Pi-hole + WireGuard + Nextcloud
• Fail2ban Setup: Brute force protection
• Router Security Hardening: Secure your network's front door
• IoT Surveillance Risks: Why smart devices are dangerous