VLANs at home: segmenting your network without losing the weekend

Key takeaways

• On a flat network, every device can reach every other one: a compromised smart device can see your file shares.
• A VLAN separates networks logically over the same cabling — you need a switch and a router that support it.
• A VLAN only separates: without firewall rules between segments, the router happily lets them talk.
• Three pitfalls stall almost every setup: the misconfigured switch port, service discovery that no longer crosses, and missing DHCP on the new segment.
• Start with a single extra segment for your smart devices: that is where the benefit-to-effort ratio is best.

In most homes, the network is flat: a single subnet where everything lives side by side. The work laptop, a guest's phone, the file server, the camera bought on sale and the smart bulb are all direct neighbors, free to talk to one another.

As long as nothing goes wrong, you never notice. The problem shows up the day one of those devices stops being trustworthy.

Why a flat network is a problem

Consumer smart devices share three annoying traits: they get few patches or none at all, they stay in service for years, and they often run embedded software nobody audits.

On a flat network, a device like that, once compromised, can scan your entire network, discover your file shares, try passwords against your admin interfaces, and act as a durable foothold toward the outside. It does not need to be powerful: it only needs to be there.

Segmentation does not make that device safe. It makes sure that once it is compromised, it no longer sees anything worth having.

What a VLAN does — and does not do

A VLAN logically separates several networks over the same physical cabling. Each segment becomes its own broadcast domain: devices on one segment do not directly see those on another.

That takes two components: a managed switch, able to say which port belongs to which segment, and a router able to handle several networks and filter between them. An ISP-supplied box rarely can.

And here is the central misconception, the one that ruins half of these setups: a VLAN separates, it does not isolate. The router sits on every segment and passes traffic between them, often with no restriction by default. If you create three VLANs without writing a single filtering rule, you have done some tidying — not security.

A sensible split

No need to aim for eight segments on day one. Four are enough, and they can be rolled out gradually:

• Main: your computers and phones, the devices you trust.
• Smart devices: everything connected that you do not control. Internet access, no access to the rest.
• Guests: internet only, full isolation, including between guest devices themselves.
• Servers: NAS, hypervisor, self-hosted services. Reachable from the main segment, but unable to initiate a connection back to it.

That last asymmetry matters and often gets forgotten: a compromised server must not be able to attack your workstations. The direction of the connections you allow counts just as much as the list of segments.

The three pitfalls that stall everyone

The misconfigured switch port. A port carrying a single segment has to be configured differently from a port carrying several — typically the one going to the router or to an access point. It is the number one cause of an unreachable device. Symptom: the link comes up, but nothing goes through.

Forgotten DHCP. Each segment is a full network in its own right: it needs its own subnet, gateway, address range and DNS server. Creating the VLAN without declaring all of that produces devices that are connected but receive no configuration. Symptom: no IP address at all.

Service discovery that no longer crosses. Printing, video streaming and home automation rely on locally broadcast messages — which, by design, do not cross segment boundaries. It is the most visible day-to-day trade-off. The answer is a discovery relay between the segments concerned, plus a firewall rule explicitly allowing the traffic. Do not reopen everything: allow that specific service, between those two specific segments.

Where to start

The approach that saves you from spending a weekend putting everything back together: add a single segment, for your smart devices.

You leave the existing network untouched, create a second dedicated wireless network, move the bulbs, plugs and cameras onto it, and write one single rule: this segment reaches the internet, and nothing else.

That gets you most of the benefit — the least trustworthy devices are pushed out of the way — with minimal risk of breakage. You spend a few days checking what stopped working, adjust the relays you need, and only add the next segment once this one is stable.

Key takeaways

Segmentation does not prevent a device from being compromised: it limits what that compromise buys. A VLAN with no firewall rules brings nothing, a segment with no DHCP does not work, and service discovery will always need an explicit relay. Take them one at a time, and start with the one that protects the most: your smart devices.