homelab-vlan-segmentation

Segmenting home networks into VLANs for IoT, guest, trusted, and server traffic using UniFi, pfSense/OPNsense, and MikroTik — including switch trunk config, firewall rules, and wireless SSID mapping. Use when splitting a home network into IoT, guest, trusted, and server VLANs on UniFi, pfSense/OPNsense, or MikroTik.

6,636
installs: 0 up / 0 down, score 0.00
votes
In the catalog since: 1 Oct 2026
From: affaan-m/ecc

Get it through your agent

Skill instructions

Rendered from the published SKILL.md, 306 lines.

Homelab VLAN Segmentation

How to split a home network into isolated VLANs so IoT devices, guests, and your main PCs cannot talk to each other. The most impactful security upgrade for a home network.

All firewall rules shown here add isolation between segments — they do not remove existing protections. Apply changes in a maintenance window and verify connectivity between segments after each step before moving on.

When to Use

Setting up VLANs on a home network for the first time
Isolating IoT devices (smart bulbs, cameras, TVs) from trusted devices
Creating a guest Wi-Fi network that cannot reach home devices
Explaining how VLANs work to someone unfamiliar with the concept
Configuring trunk ports, access ports, and SSID-to-VLAN mapping
Troubleshooting inter-VLAN routing or firewall rule issues on pfSense/OPNsense/UniFi

How It Works

Without VLANs — flat network:
  All devices on 192.168.1.0/24
  Smart TV (potential malware) → can reach your NAS, PCs, everything

With VLANs:
  VLAN 10 — Trusted    192.168.10.0/24  (PCs, phones, laptops)
  VLAN 20 — IoT        192.168.20.0/24  (smart TV, bulbs, cameras)
  VLAN 30 — Servers    192.168.30.0/24  (NAS, Pi, VMs)
  VLAN 40 — Guest      192.168.40.0/24  (visitor Wi-Fi)
  VLAN 99 — Management 192.168.99.0/24  (switch/AP web UIs)

  Smart TV → blocked from reaching 192.168.10.0/24 and 192.168.30.0/24
  Guests → internet only, cannot see any home devices

VLAN Design Template

VLAN  Name        Subnet              Gateway         Purpose
10    trusted     192.168.10.0/24     192.168.10.1    PCs, phones, laptops
20    iot         192.168.20.0/24     192.168.20.1    Smart home devices
30    servers     192.168.30.0/24     192.168.30.1    NAS, Pi, self-hosted
40    guest       192.168.40.0/24     192.168.40.1    Visitor Wi-Fi
99    management  192.168.99.0/24     192.168.99.1    Network gear web UIs

Examples

Typical homelab with UniFi AP and managed switch:

Scenario: 3-bedroom house, UniFi Dream Machine + UniFi 8-port switch + 2 APs

VLAN 10 — Trusted    192.168.10.0/24   MacBook, iPhones, iPad
VLAN 20 — IoT        192.168.20.0/24   Nest thermostat, Philips Hue, Ring doorbell, smart TVs
VLAN 30 — Servers    192.168.30.0/24   Synology NAS (192.168.30.10), Pi-hole (192.168.30.2)
VLAN 40 — Guest      192.168.40.0/24   Visitor Wi-Fi — internet only

SSID → VLAN mapping:
  "Home"      → VLAN 10 (WPA2, strong password, trusted devices only)
  "IoT"       → VLAN 20 (WPA2, separate password, printed on router for setup)
  "Guest"     → VLAN 40 (WPA2, simple password you can share freely)

Switch port behavior:
  Port 1  → trunk to router (tagged VLANs 10,20,30,40,99)
  Port 2  → trunk to APs (tagged VLANs 10,20,40; AP handles per-SSID tagging)
  Port 3  → access VLAN 30 (NAS — untagged, no VLAN awareness needed)
  Port 4  → access VLAN 30 (Pi-hole — untagged)
  Port 5–8 → access VLAN 10 (wired workstations)

Firewall rules applied (all rules add isolation, none remove existing protections):
  IoT → Trusted: BLOCK
  IoT → Servers: BLOCK except 192.168.30.2:53 (Pi-hole DNS allowed)
  IoT → Internet: ALLOW
  Guest → Local networks: BLOCK
  Guest → Internet: ALLOW
  Trusted → everywhere: ALLOW

UniFi Configuration

Create Networks in UniFi Controller

Settings → Networks → Create New Network

For each VLAN:
  Name: IoT
  Purpose: Corporate  (gives DHCP + routing)
  VLAN ID: 20
  Network: 192.168.20.0/24
  Gateway IP: 192.168.20.1
  DHCP: Enable
  DHCP Range: 192.168.20.100 – 192.168.20.254

Map SSIDs to VLANs (UniFi)

Settings → WiFi → Create New WiFi

  Name: IoT-Network
  Password: <separate password>
  Network: IoT  ← select your VLAN here
  # All devices connecting to this SSID land in VLAN 20

  Name: Guest
  Password: <guest password>
  Network: Guest
  Guest Policy: Enable  ← isolates guests from each other too

UniFi Firewall Rules (Traffic Rules)

Settings → Traffic & Security → Traffic Rules

# Block IoT from reaching Trusted VLAN
  Action: Block

Show the whole skill (186 more lines)

Category: Local Network Source: IoT (192.168.20.0/24) Destination: Trusted (192.168.10.0/24)

Allow IoT to reach internet only

Action: Allow Source: IoT Destination: Internet

Block Guest from all local networks

Action: Block Source: Guest Destination: Local Networks


## pfSense / OPNsense Configuration

### Create VLANs

Interfaces → Assignments → VLANs → Add

Parent Interface: em1 (your LAN NIC) VLAN Tag: 20 Description: IoT

Repeat for each VLAN, then assign each VLAN to an interface:

Interfaces → Assignments → Add Select the VLAN you created → click Add Enable the interface, set IP to gateway address (192.168.20.1/24)


### DHCP for Each VLAN

Services → DHCP Server → Select your VLAN interface

Enable DHCP Range: 192.168.20.100 to 192.168.20.254 DNS Servers: 192.168.30.2 ← Pi-hole IP if you have one


### Firewall Rules (pfSense/OPNsense)

Rules are processed top-to-bottom, first match wins.

On the IoT interface (VLAN 20):

Rule 1: Allow IoT → Pi-hole DNS ← MUST come before the RFC1918 block rule Protocol: UDP/TCP Source: IoT net Destination: 192.168.30.2 port 53 Action: Allow

Rule 2: Block IoT → RFC1918 (all private IP ranges) Protocol: any Source: IoT net Destination: RFC1918 (192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12) Action: Block

Rule 3: Allow IoT → internet Protocol: any Source: IoT net Destination: any Action: Allow

On the Trusted interface (VLAN 10):

Allow all (trusted devices can reach everything) Source: Trusted net Destination: any Action: Allow

Additional exceptions for IoT devices that need specific local services:

Insert before Rule 2 (the RFC1918 block): Protocol: TCP Source: IoT net Destination: 192.168.30.x port 8123 ← Home Assistant Action: Allow


## MikroTik Configuration

Step 1: Create a bridge with VLAN filtering enabled

/interface bridge add name=bridge vlan-filtering=yes

Step 2: Add physical ports to the bridge

Trunk port to router/uplink (tagged for all VLANs)

/interface bridge port add bridge=bridge interface=ether1 frame-types=admit-only-vlan-tagged

Access port for trusted devices (untagged VLAN 10)

/interface bridge port add bridge=bridge interface=ether2 pvid=10 frame-types=admit-only-untagged-and-priority-tagged

Access port for IoT devices (untagged VLAN 20)

/interface bridge port add bridge=bridge interface=ether3 pvid=20 frame-types=admit-only-untagged-and-priority-tagged

Step 3: Define which VLANs are allowed on which ports

/interface bridge vlan add bridge=bridge tagged=ether1 untagged=ether2 vlan-ids=10 add bridge=bridge tagged=ether1 untagged=ether3 vlan-ids=20

Step 4: Create VLAN interfaces on the bridge (gateway IPs)

/interface vlan add interface=bridge name=vlan10 vlan-id=10 add interface=bridge name=vlan20 vlan-id=20

Step 5: Assign gateway IPs

/ip address add interface=vlan10 address=192.168.10.1/24 add interface=vlan20 address=192.168.20.1/24

Step 6: DHCP pools and servers

/ip pool add name=pool-trusted ranges=192.168.10.100-192.168.10.254 add name=pool-iot ranges=192.168.20.100-192.168.20.254

/ip dhcp-server add interface=vlan10 address-pool=pool-trusted name=dhcp-trusted add interface=vlan20 address-pool=pool-iot name=dhcp-iot

/ip dhcp-server network add address=192.168.10.0/24 gateway=192.168.10.1 add address=192.168.20.0/24 gateway=192.168.20.1

Step 7: Firewall — block IoT from reaching trusted VLAN

/ip firewall filter add chain=forward src-address=192.168.20.0/24 dst-address=192.168.10.0/24
action=drop comment="Block IoT to Trusted"


## Switch Trunk vs Access Ports

Trunk port: carries multiple VLANs (tagged) — connects switch-to-switch, switch-to-router, switch-to-AP

Access port: carries one VLAN (untagged) — connects to end devices (PC, camera, NAS)

A managed switch port connected to your router should be a trunk:

Allowed VLANs: 10, 20, 30, 40, 99

A port connecting to a PC should be an access port:

VLAN: 10 (trusted) No tagging — the PC does not know or care about VLANs

A port connecting to an AP must be a trunk:

The AP tags traffic from each SSID with the right VLAN ID Allowed VLANs: 10, 20, 40 (whichever SSIDs the AP serves)


## Anti-Patterns

BAD: Creating VLANs without adding firewall rules

VLANs without firewall rules do not provide security — inter-VLAN routing is open by default

GOOD: Add explicit block rules immediately after creating VLANs

BAD: Putting the Pi-hole in the IoT VLAN

IoT devices can reach it but trusted devices cannot (without extra rules)

GOOD: Pi-hole in the Servers VLAN with a rule allowing all VLANs to reach port 53

BAD: Native VLAN equals management VLAN

Untagged traffic landing in your management VLAN enables VLAN hopping attacks

GOOD: Use a dedicated unused VLAN as native (e.g. VLAN 999), keep management traffic tagged

BAD: Same Wi-Fi password for IoT SSID and trusted SSID

Anyone who learns the password can connect IoT devices to the wrong segment


## Best Practices

- Start with 4 VLANs: Trusted, IoT, Servers, Guest — add more as needed
- Put Pi-hole in the Servers VLAN (192.168.30.x)
- Add a firewall rule allowing DNS (port 53) from all VLANs to the Pi-hole IP — before any RFC1918 block rule
- Test isolation after every rule change: from the IoT VLAN, try to ping a trusted device — it should fail
- Use a management VLAN for switch and AP web UIs and restrict access to the Trusted VLAN only
- Document your VLAN design in a table (VLAN ID, name, subnet, purpose)

## Related Skills

- homelab-network-setup
- homelab-pihole-dns
- homelab-wireguard-vpn

Get it through your agent

Call the Graph-of-Skills MCP server's retrieve_skill_bundle tool and it returns this skill's text inside your budget.

{
  "tool": "retrieve_skill_bundle",
  "arguments": {
    "query": "homelab-vlan-segmentation"
  }
}

New to this? Set up Graph-of-Skills or get a free key. The text on this page comes from its authors: how skills are sourced and what we check. If none fits your task, your agent can write a skill for your own library. To keep a skill from your own library on a machine, see how to install one of your skills.

Share on X Share on LinkedIn Share on Bluesky Share on Hacker News

Share on Reddit

Source

Listing on skills.sh

From affaan-m/ecc via skills.sh

Related skills

homelab-network-readiness
Readiness checklist for homelab VLAN segmentation, local DNS filtering (Pi-hole, AdGuard Home), and WireGuard-style remote access. Use when planning or reviewing home network changes — splitting a flat network into trusted, IoT, guest, or management VLANs, moving DHCP to a local resolver, or adding VPN access — before changing router, firewall, DHCP, or VPN configuration.
6,731 installs
homelab-wireguard-vpn
WireGuard VPN server setup, peer configuration, key generation, split tunneling vs full tunnel routing, and remote access to a home network from mobile and laptop clients. Use when setting up WireGuard for remote access to a home network, or deciding between split and full tunnel routing.
6,702 installs
api-sec
Entry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deeper API topic skill.
3,905 installs
google-cloud-networking-observability
Investigates Google Cloud networking issues by analyzing GCP logs, metrics, and diagnostics. Use when investigating dropped network traffic, packet drops, drop reasons, VPC Flow Logs (including Private Service Connect / PSC, serverless / App Engine Direct VPC, and cost estimation), NAT, firewall, or threat logs, querying latency and throughput metrics, or running Connectivity Tests for path diagnostics. Don't use for generic VM management or non-observability tasks.
11,889 installs
k8s-security-policies
Implement Kubernetes security policies including NetworkPolicy, PodSecurityPolicy, and RBAC for production-grade security. Use when securing Kubernetes clusters, implementing network isolation, or enforcing pod security standards.
14,727 installs