Segmenting home networks into VLANs for IoT, guest, trusted, and server traffic using UniFi, pfSense/OPNsense, and MikroTik — including switch trunk config, firewall rules, and wireless SSID mapping. Use when splitting a home network into IoT, guest, trusted, and server VLANs on UniFi, pfSense/OPNse

Homelab VLAN Segmentation How to split a home network into isolated VLANs so IoT devices, guests, and your main PCs cannot talk to each other. The most impactful security upgrade for a home network. All firewall rules shown here add isolation between segments — they do not remove existing protections. Apply changes in a maintenance window and verify connectivity between segments after each step before moving on. When to Use Setting up VLANs on a home network for the first time Isolating IoT devices (smart bulbs, cameras, TVs) from trusted devices Creating a guest Wi Fi network that cannot reach home devices Explaining how VLANs work to someone unfamiliar with the concept Configuring trunk ports, access ports, and SSID to VLAN mapping Troubleshooting inter VLAN routing or firewall rule issues on pfSense/OPNsense/UniFi How It Works VLAN Design Template Examples Typical homelab with UniFi AP and managed switch: UniFi Configuration Create Networks in UniFi Controller Map SSIDs to VLANs (UniFi) UniFi Firewall Rules (Traffic Rules) pfSense / OPNsense Configuration Create VLANs DHCP for Each VLAN Firewall Rules (pfSense/OPNsense) MikroTik Configuration Switch Trunk vs Access Ports Anti Patterns Best Practices Start with 4 VLANs: Trusted, IoT, Servers, Guest — add more as needed Put Pi hole in the Servers VLAN (192.168.30.x) Add a firewall rule allowing DNS (port 53) from all VLANs to the Pi hole IP — before any RFC1918 block rule Test isolation after every rule change: from the IoT VLAN, try to ping a trusted device — it should fail Use a management VLAN for switch and AP web UIs and restrict access to the Trusted VLAN only Document your VLAN design in a table (VLAN ID, name, subnet, purpose) Related Skills homelab network setup homelab pihole dns homelab wireguard vpn

homelab-vlan-segmentation