VLANs in plain English
Sooner or later every homelab article mentions VLANs, usually as if you already know what they are. This page is the explanation I wish I’d had. You don’t need VLANs for any beginner build here, but you’ll understand the later articles much better once this clicks.
The problem VLANs solve
Out of the box, everything on your home network can talk to everything else: your laptop, your phone, the smart plugs, the cheap camera you bought online, the TV. If one of those gets compromised, it can reach all the others.
A VLAN (virtual LAN) splits one physical network into several separate ones. Same cables, same switches, but devices on different VLANs can’t see each other unless you deliberately allow it. A common home layout looks like this:
| VLAN | Who’s on it | Can reach |
|---|---|---|
| Main | Laptops and phones | Everything you allow |
| IoT | Smart plugs, TVs, speakers | The internet, little else |
| Cameras | Security cameras | Only the recording server |
| Servers | NAS, Docker host | What the other VLANs are allowed to reach |
| Guest | Visitors | The internet only |
How it works, without the jargon
Each VLAN gets a number, called a tag. When traffic for VLAN 20 travels over a cable that carries several VLANs (a trunk), each packet gets a small label saying “I belong to 20”. Switch ports that connect a single ordinary device (an access port) strip that label off, so the device never knows VLANs exist; it just sees its own little network.
Each VLAN usually gets its own range of addresses too, so 192.0.2.x might be Main and 198.51.100.x might be IoT. Matching the VLAN number to part of the address (VLAN 20 uses .20.x) makes life much easier when you’re staring at a log at midnight.
The router or firewall sits between the VLANs and decides who may talk to whom, using firewall rules. That’s where the real security comes from.
What you need
- A router or firewall that supports VLANs (pfSense, OPNsense, UniFi, Omada and many others; most basic ISP routers don’t).
- Managed switches, if devices plug in by cable to more than one VLAN.
- Access points that can map Wi-Fi networks to VLANs, so your “IoT” Wi-Fi network lands devices on the IoT VLAN.
Mistakes I made, so you can skip them
- Rules apply in order. Firewall rules are checked top to bottom, and the first match wins. During a security review, Claude found a “block everything else” rule on one of my VLANs that never fired, because a broad “allow everything” rule sat above it. (In that case I decided to keep the behavior, but now it’s a choice, not an accident.) Read your rules top to bottom like the firewall does.
- Don’t forget ping. When I built a new lab VLAN, Claude wrote “allow traffic to the router” rules for it that only allowed TCP and UDP (copied from an older VLAN that had the same blind spot). Ping uses ICMP, so ping failed, and it looked exactly like the switch port was misconfigured. Claude ran a packet capture, saw the address lookup succeed while the pings went unanswered, and traced it to the rule. When ping fails across VLANs, check the protocol on your allow rules.
- Broadcasts don’t cross VLANs. Discovery features (casting, Wake-on-LAN, some smart-home apps) rely on broadcasts that stay inside one VLAN. Expect some devices to “disappear” from apps after you split them, and plan to relay or allow those specific things.
- Check every interface. If you ask “is this VLAN isolated from everything?”, check the rules on every other VLAN too, not just the new one. When I asked whether a new VLAN was really isolated, Claude checked every other VLAN’s rules as well and found a gap on my camera VLAN, which had its own older, more permissive rules.
When it’s worth it
VLANs are worth it once you have devices you don’t fully trust (cheap cameras and smart plugs are the usual reason), or once you start running things others will use. They’re not worth it on day one of your first homelab. Get a server running and enjoy it first; segment later.