VLAN Basics for Home Labs: How to Segment Your Network

Your smart plugs, cameras, and robot vacuum probably share the same network as your laptop and your NAS. If one of them gets compromised, nothing stops it from reaching everything else. That is the exact problem VLANs solve, and modern prosumer gear makes it achievable at home.

This guide covers how VLANs actually work and the hardware you need. It also covers a practical home-lab layout and the mistakes that quietly undo isolation.

What a VLAN Actually Does (and Why Subnets Alone Aren’t Enough)

A VLAN splits one physical network into separate broadcast domains using software, not extra cables. Devices on different VLANs cannot see each other’s traffic by default. A subnet gives each group its own address range. A VLAN is what actually keeps that traffic apart at Layer 2.

Plugging every device into the same switch puts them all in one broadcast domain. Every ARP request, every DHCP broadcast, every bit of local chatter reaches every device on that switch. A compromised device can scan, sniff, and probe everything else with no extra effort.

Giving devices different subnets, like 192.168.10.0/24 for IoT and 192.168.20.0/24 for trusted devices, helps with organization. It does not stop broadcast traffic on a flat, unswitched network. Our subnetting beginner’s guide covers how subnets work on their own.

A VLAN adds the missing piece. It tags traffic so a switch keeps each group’s frames on their own logical network. That holds even when every device shares the same physical switch and cabling.

Access Ports vs Trunk Ports: How 802.1Q Tagging Works

Every switch port runs in one of two modes. An access port belongs to a single VLAN and carries untagged traffic. A trunk port carries multiple VLANs at once, each frame tagged with a VLAN ID defined by IEEE 802.1Q.

Most devices, like a laptop or a camera, plug into an access port. The switch assigns that port to one VLAN, and the device never sees a tag. As far as the device knows, it is on a normal, ordinary network.

A trunk port is different. It carries traffic for several VLANs over one cable. That is exactly what you need between a switch and a router, or a switch and a VLAN-aware access point. Cisco’s own Meraki VLAN tagging documentation uses this same access-versus-trunk split, and the terminology carries across every major vendor.

Every trunk port also has a native VLAN, the one VLAN allowed to pass untagged. Getting the native VLAN wrong is one of the most common home-lab mistakes, covered later in this guide.

Hardware You Actually Need for VLANs at Home

VLANs need three things a typical ISP router does not have. A managed switch that supports 802.1Q tagging. A VLAN-aware access point that can map SSIDs to VLANs. A router or firewall that can route between them.

The switch is non-negotiable. An unmanaged switch, the kind with no web interface, cannot tag or separate anything. Look for “managed” or “smart-managed” in the product name, from brands like UniFi, TP-Link Omada, MikroTik, or Netgear.

Wireless devices need a VLAN-aware access point too. Most mainstream consumer Wi-Fi routers cannot map separate SSIDs to separate VLANs. A handful of flagship models, like ASUS’s GT and Pro series, have added basic VLAN support. Dedicated prosumer options like UniFi APs and TP-Link Omada EAPs still handle this more completely, broadcasting one SSID per VLAN.

Finally, something has to route and filter traffic between VLANs. A dedicated firewall like pfSense or OPNsense works well for this at home. So does an all-in-one gateway like a UniFi Dream Machine or Omada router.

A Practical Home-Lab VLAN Layout

A workable home-lab scheme rarely needs more than four or five VLANs. Trusted devices, IoT gear, cameras, guests, and a home-lab or management network each get their own VLAN and matching subnet.

Keep VLAN IDs and subnets predictable. A common pattern uses the VLAN ID as the third octet of the subnet, so VLAN 20 becomes 10.0.20.0/24. That makes traffic instantly recognizable in logs. Use our subnet calculator to size each range, or read CIDR notation explained if the slash numbers are unfamiliar.

These ranges all come from the private space defined in RFC 1918. Our guide to public versus private IP addresses covers the same ranges. Skip the gaps between VLAN IDs on purpose. They leave room to add a VLAN later without renumbering everything.

Setting Up VLANs Step by Step

Setting up VLANs follows the same order regardless of brand. Create the VLAN IDs first, configure trunk ports on uplinks, then assign access ports and SSIDs to their intended VLAN.

1. Create each VLAN ID and name in your router or controller, matching the layout you planned.
2. Configure the uplink port between your switch and router as a trunk, tagged for every VLAN.
3. Configure the uplink port between your switch and access point the same way, as a trunk.
4. Set every end-device port to access mode, assigned to the one VLAN that device belongs on.
5. Create a separate SSID for each wireless VLAN, mapping each SSID to its VLAN ID.
6. Verify a device on each VLAN gets the expected subnet and can reach the internet.

DHCP and DNS: Every VLAN Needs Its Own

Each VLAN needs its own DHCP scope and gateway, or devices on it get no address at all. Most VLAN-aware routers let you run a separate DHCP server per VLAN interface automatically.

A VLAN with no DHCP scope behaves exactly like a network with a dead DHCP server. Devices sit with no address, or fall back to a self-assigned one. Our guide on how DHCP works covers the handshake behind every lease, VLAN or not.

Give each VLAN’s router interface its own IP, matching that VLAN’s subnet. That interface then becomes the gateway and DHCP server for the VLAN. Most consumer-grade VLAN routers set this up automatically once you create the VLAN and assign a subnet.

VLANs Are Not a Firewall: Inter-VLAN Routing Rules

Creating VLANs only separates broadcast domains. It does not stop routed traffic from moving between them. Without explicit deny rules on your router, a compromised IoT device can still reach your file server through the router.

This surprises a lot of first-time VLAN builders. VLANs stop devices from seeing each other’s local traffic directly. They do nothing to stop a router from happily forwarding packets between VLANs, unless you tell it not to.

The fix is a default-deny policy between VLANs, then explicit allow rules for what actually needs to cross. Put an allow established/related rule at the top of every VLAN’s rule set first. Without it, reply traffic gets blocked by the other side’s default deny, even for connections the trusted VLAN itself started. A sound starting point beneath that:

• Trusted VLAN: allow to anywhere, including other VLANs and the internet.
• IoT VLAN: allow to the internet only, deny every other private network.
• Camera VLAN: allow to the internet only, plus a narrow rule letting your home-lab VLAN reach the camera stream.
• Guest VLAN: allow to the internet only, deny all private ranges, including your own.

This is the same logic covered in our guide to how firewalls work. Here it just applies at the boundary between VLANs instead of the internet.

VLAN Hopping: The Native VLAN Risk Most Guides Skip

An attacker on the trunk’s native VLAN can craft a frame with two stacked tags. That reaches a supposedly isolated VLAN. A second technique, switch spoofing, negotiates a rogue trunk instead. Both share the same fix: hardcode every port and never leave real traffic on VLAN 1.

Double Tagging

Double tagging works because of one specific mistake. That mistake is leaving VLAN 1 as both the native VLAN and a VLAN with real devices on it. An attacker must be connected to an access port on that native VLAN. Without that, the attack does not work at all.

A trunk strips the outer tag on the native VLAN. The switch behind it then reads the second, hidden tag as if it arrived legitimately. The frame lands on the target VLAN as though it belonged there all along.

Cisco’s own Meraki VLAN documentation recommends never putting active devices on VLAN 1 at all. Combine that with changing the native VLAN on every trunk to an unused ID. The double-tagging attack then has no VLAN 1 traffic left to hide behind.

Switch Spoofing

Switch spoofing is the other classic VLAN hopping technique, and most home-lab guides skip it entirely. An access port left in an auto-trunking mode can negotiate a rogue trunk link with an attacker’s device. It typically uses Cisco’s Dynamic Trunking Protocol, or a vendor equivalent.

Once that rogue trunk exists, the attacker’s device receives tagged traffic for every VLAN carried on it, not just one. The fix is simple. Hardcode every access port to access mode, and disable automatic trunk negotiation on ports that should never become trunks.

Common Home-Lab VLAN Mistakes

Most home-lab VLAN failures trace back to a handful of repeated errors. Forgetting to tag the uplink trunk is the most common one. Mismatching the native VLAN and using a non-VLAN-aware AP are close behind.

• Forgetting to tag a trunk port for every VLAN it should carry, silently dropping traffic for the missed VLAN.
• Using an access point that cannot map SSIDs to VLANs. Wi-Fi traffic then lands on one flat network regardless of switch config.
• Leaving the native VLAN on every trunk set to VLAN 1, the default VLAN hopping target.
• Creating VLANs but skipping firewall rules, so isolation exists on paper but not in practice.
• Placing a Zigbee or Z-Wave coordinator on a different VLAN than the hub that controls it, breaking device pairing entirely.

Why AirPlay and Chromecast Break Across VLANs

This is the mistake that generates the most support threads. Put an Apple TV on the IoT VLAN and an iPhone on the trusted VLAN. AirPlay silently stops finding it. Chromecast and Sonos have the same problem.

The cause is mDNS, the discovery protocol behind AirPlay, Chromecast, and AirPrint. It relies on link-local multicast, which by design never crosses a VLAN or subnet boundary. Segmenting your network is exactly what breaks device discovery between VLANs.

The fix is an mDNS reflector, sometimes called an mDNS proxy or Bonjour gateway. It re-broadcasts discovery traffic between the VLANs you choose, without merging them into one broadcast domain. Most VLAN-capable routers and gateways, including UniFi’s Multicast DNS Proxy, include this as a built-in feature.

Enable the reflector only between the VLANs that actually need discovery, like trusted and IoT. Leave your guest VLAN out of it entirely, so visitor devices cannot discover anything on your network.

Most of these show up the same way. A device connects fine but cannot reach something it should, or reaches something it should not. Our network troubleshooting guide covers the general diagnostic steps if a VLAN change breaks connectivity.

Frequently Asked Questions

Quick answers to what home-lab builders ask most about VLANs. That covers hardware requirements, IoT isolation, and the mistakes that quietly break isolation. It also covers whether VLANs alone are enough.

Related Tools & Resources

Plan the addressing side of your VLAN layout with these NetworkCheckr tools. The subnet calculator sizes each VLAN’s range. The CIDR guide explains the notation behind every prefix you choose.