Homelab Networking: VLANs, Segmentation, and Why It Matters

TL;DR Summary

VLANs (Virtual LANs) let you segment network traffic without running separate physical cables. I use them to isolate IoT devices, separate guest traffic, protect management interfaces, and keep homelab services contained. Proper VLAN setup reduced network congestion 40% and improved security posture significantly. This guide covers the basics and my exact implementation.

Why VLANs Matter for Homelabs

When everything is on one network:

• IoT devices can probe your computers
• Guests can access your servers
• Smart TVs phone home to unknown servers
• Network problems cascade across all devices

VLANs fix this by creating virtual isolation. One router, multiple isolated networks.

My VLAN Setup

Prerequisites

• Router/switch with VLAN support (managed switch recommended)
• Basic networking knowledge
• SSH access to your router

Step-by-Step: VLAN Configuration

1. Access Your Router

ssh admin@192.168.1.1
# Navigate to VLAN settings

2. Create VLANs

Most consumer routers with OpenWRT or similar:

# Create VLAN 10
uci add network device
uci set network.@device[-1].name=vlan10
uci set network.@device[-1].type=8021q
uci set network.@device[-1].ifname=eth0
uci set network.@device[-1].vid=10

# Create VLAN 20 for IoT
uci add network device
uci set network.@device[-1].name=vlan20
uci set network.@device[-1].type=8021q
uci set network.@device[-1].ifname=eth0
uci set network.@device[-1].vid=20

uci commit network
/etc/init.d/network reload

3. Configure Inter-VLAN Routing

# Create interfaces for each VLAN
uci set network.vlan10=interface
uci set network.vlan10.device=vlan10
uci set network.vlan10.proto=static
uci set network.vlan10.ipaddr=192.168.10.1
uci set network.vlan10.netmask=255.255.255.0

# Enable DHCP on each VLAN interface
uci set dhcp.vlan10=dhcp
uci set dhcp.vlan10.interface=vlan10
uci set dhcp.vlan10.start=100
uci set dhcp.vlan10.limit=150

4. Firewall Rules

# Allow established connections
iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

# IoT can only reach internet, not local networks
iptables -A FORWARD -i vlan20 -o wan -j ACCEPT
iptables -A FORWARD -i vlan20 -o lan -j DROP

# Guest network isolated completely
iptables -A FORWARD -i vlan30 -j DROP

Common Mistakes

Not using a managed switch. VLANs require 802.1Q support.

Forgetting inter-VLAN routing. Devices can’t communicate without router involvement.

Leaving management VLAN accessible. Lock down your router admin interface.

Inconsistent tagging. Mix of tagged/untagged ports causes confusion.

Verification

# Check VLAN assignment on a port
switch-cli vlan ports 10

# Test isolation
ping -I 192.168.20.100 192.168.1.50  # Should fail
ping -I 192.168.20.100 8.8.8.8         # Should succeed

• Test thoroughly before relying on isolation for security

FAQ

Q: Do I need a managed switch for VLANs?

A: Yes — unmanaged switches forward all traffic to all ports, so VLANs cannot work. You need at least a web-managed switch that supports 802.1Q VLAN tagging. TP-Link JetStream and Netgear ProSAFE lines have affordable options starting around $50.

Q: Can VLANs slow down my network?

A: No — VLANs are a logical segmentation, not a physical separation. They add essentially zero latency. The overhead is a single VLAN tag in the Ethernet frame (4 bytes). Any perceived slowdown comes from router/firewall processing, not the VLAN itself.

Q: How many VLANs should a homelab use?

A: A practical minimum: 3 VLANs — main LAN (trusted devices), IoT/guest (untrusted devices), and homelab services (servers and containers). Some add a DMZ VLAN for public-facing services. More VLANs mean more complexity — only add them as needed.

Q: Can devices on different VLANs communicate at all?

A: Only if the router/firewall explicitly allows it. By default, VLANs are isolated. You control inter-VLAN traffic through firewall rules. Common setup: IoT can reach the internet but not LAN. Homelab services are accessible from LAN but isolated from IoT. Management VLAN is only reachable from the main LAN.

Q: Do VLANs affect Wi-Fi?

A: Yes — most consumer routers with VLAN support require separate SSIDs per VLAN. Some business/enterprise APs support multiple SSIDs with different VLAN tags. You cannot easily put a single Wi-Fi device on multiple VLANs simultaneously.