Networking / Building
Home Lab Segmentation
VLANs, firewall policy and isolated subnets across a home lab — network design learned by living with the consequences of every rule.
Started 2024-06-01 / Updated 2025-08-20
Reading about network segmentation teaches you the vocabulary. Running it at home, where a bad rule breaks the television, teaches you the design.
The goal was a lab network where experimental machines cannot reach anything that matters, and where every allowed path is a decision I can explain.
The segmentation model
Traffic is split into zones with default-deny between them and narrow, documented exceptions.
- Trusted: daily-driver machines and work devices.
- Lab: experimental VMs and containers, no path to trusted.
- IoT: no outbound-to-local, no local-to-outbound beyond vendor endpoints.
- Management: switch, firewall and hypervisor interfaces, reachable from one host only.
What broke first
Service discovery. Almost every consumer device assumes a flat network and a chatty broadcast domain. Segmentation forces you to decide, explicitly, which discovery traffic is worth relaying.
What I'd do differently
Write the firewall policy before the VLANs. The zones are easy; the exceptions are the actual architecture, and retrofitting them into an existing topology is where the weekends went.
Setup
- Domain
- Networking
- Zones
- Trusted / Lab / IoT / Management
- Default policy
- Deny between zones
- Scope
- Self-owned equipment only
Tags
Stack
- VLANs
- Firewall policy
- DHCP/DNS
- Managed switching
- Hypervisor networking
Domain
All Networking experimentsAuthorised, ethical and controlled
All cybersecurity and penetration-testing activity is performed in authorised, ethical and controlled lab environments, on systems I own or have explicit written permission to test.
Want the detail behind this experiment?
If this overlaps with something you're building, I'm happy to share what worked and what didn't.