VLANs for a home that doesn't need a SOC

I run four VLANs at home. Four. Not seventeen. Not one. The setup is enough to keep the IoT devices from talking to the laptop and to keep the kids’ devices on a schedule, without me having to think about it.

Here’s the segmentation.

The four VLANs

VLAN	Name	What lives there	DHCP range
10	trusted	Laptops, phones, my desktop	10.0.10.0/24
20	iot	Smart bulbs, switches, the thermostat, the robot vacuum	10.0.20.0/24
30	guest	Friends’ phones, the kids’ friends’ devices, the occasional Airbnb guest	10.0.30.0/24
40	lab	Proxmox cluster nodes, the NAS, the PBS host, anything I tinker with	10.0.40.0/24

The lab VLAN is where the homelab lives. It’s the only VLAN that can talk to the management interfaces of the Proxmox cluster. The trusted VLAN can reach the lab’s services (the Jellyfin media server, the Gitea instance) but not the Proxmox web UI. The iot and guest VLANs can reach the internet and nothing else.

The inter-VLAN rules

The pfSense firewall rules between the VLANs are short:

• trusted to lab: allow specific ports (the services I want from the lab)
• lab to trusted: deny (the lab doesn’t initiate connections to the laptop)
• trusted to iot: deny (my laptop doesn’t talk to the bulbs)
• iot to trusted: deny (the bulbs don’t talk to my laptop)
• iot to lab: deny (the bulbs don’t talk to the NAS)
• guest to anything: deny (guests get internet only)
• Anything to anything: deny (the default-deny rule at the bottom)

The rule order matters. pfSense evaluates top-to-bottom. The default-deny at the bottom catches anything the rules above didn’t catch.

What this gets me

• A compromised IoT device can’t talk to my laptop. The botnet-2024-iot-lightbulb can’t phone home through my network. It can phone home to its C2 server on the internet, but it can’t pivot to anything else.
• The kids’ devices on guest can’t talk to the NAS, can’t see the lab, can’t reach the printer. They get internet. They can play Minecraft with their friends. They can’t get into anything they shouldn’t.
• My tinkering on the lab can’t accidentally affect the trusted network. If I spin up a new VM and give it a bad firewall rule, the worst case is the lab gets weird. The laptop and the IoT devices are unaffected.
• The guest network is a single SSID with a simple password I can change. Guests get internet, period.

What this doesn’t get me

This is not a SOC. There is no IDS. There is no log aggregation. There is no incident response plan. There is no threat hunting. The VLANs are the same segmentation a small business would do in 2010. That’s the right level for a home. Anything more is theater.

The setup

• pfSense on the homelab, with one NIC for each VLAN
• A managed switch (the MikroTik CRS305) with VLAN tagging configured
• Three wireless access points (one in the office, one in the living room, one in the garage), each broadcasting the four SSIDs mapped to the four VLANs
• The pihole on pihole-01 in the lab VLAN, providing DNS for trusted, iot, and guest (the lab uses pfSense’s resolver directly)

The wireless is the part that took the most iteration. The APs need to support VLAN tagging on the SSID. The MikroTik hAP ax³ does. The UniFi U6 Lite does. The TP-Link EAP245 does. I tried all three at various points. They all work. The MikroTik is the cheapest per-feature.

The thing I almost forgot

The default gateway. Each VLAN needs a default gateway pointing at the pfSense interface for that VLAN. I forgot this on the iot VLAN when I first set it up. The devices on iot could talk to each other (because they were on the same subnet) but couldn’t reach the internet. The bulbs worked. The cloud control of the bulbs didn’t. Took me 20 minutes to figure out.

The maintenance

Almost none. The VLANs are static. The DHCP ranges are static. The firewall rules are static. The only thing that changes is adding new devices to the right VLAN, which is a one-time setup per device.

If you want to go further: add an mgmt VLAN for the network gear itself (the APs, the switches, the cable modem). I have those on the lab VLAN because they’re a small surface and I trust them. If I were doing this for a small business, I’d add the mgmt VLAN.