Network Segmentation in the Homelab

Why Segment Your Network?

A flat network where everything can talk to everything is convenient but insecure. Network segmentation limits the blast radius when something goes wrong - whether that's a compromised IoT device or a misconfigured service.

VLAN Design

I use VLANs to create isolated network segments. Each VLAN has its own subnet and firewall rules:

• *VLAN 10 - Management (network gear, IPMI)
• *VLAN 20 - Trusted (workstations, laptops)
• *VLAN 30 - Servers (VMs, containers)
• *VLAN 40 - IoT (smart devices, isolated)
• *VLAN 50 - Guest (internet only)

Network Topology:
┌────────────────────────────────────────────────┐
│                   Internet                      │
└────────────────────┬───────────────────────────┘
                     │
              ┌──────┴──────┐
              │   pfSense   │
              │  (Firewall) │
              └──────┬──────┘
                     │
          ┌──────────┼──────────┐
          │          │          │
    ┌─────┴────┐ ┌───┴───┐ ┌───┴────┐
    │ VLAN 20  │ │VLAN 30│ │VLAN 40 │
    │ Trusted  │ │Servers│ │  IoT   │
    └──────────┘ └───────┘ └────────┘

Firewall Rules

The firewall is where network segmentation becomes real. I follow the principle of least privilege - deny by default, allow only what's needed:

• *IoT can reach the internet but not other VLANs
• *Servers can be accessed from Trusted VLAN only
• *Guest VLAN gets internet access, nothing else
• *Management VLAN is only accessible from specific hosts