ecc-homelab-vlan-segmentation

Create separate VLANs for trusted, IoT, servers, and guest devices, each with its own subnet and DHCP scope. Then add firewall rules blocking IoT and guest VLANs from reaching private address ranges while allowing internet access.

In the UniFi Controller, create a network per VLAN with its VLAN ID and subnet, then create WiFi networks and assign each SSID to the corresponding VLAN network. Add traffic rules to block IoT and guest networks from reaching local networks.

No. VLANs without firewall rules do not provide isolation because inter-VLAN routing is open by default. You must add explicit block rules immediately after creating VLANs and test that devices in one VLAN cannot reach another.

A trunk port carries multiple tagged VLANs and connects switches, routers, and access points. An access port carries a single untagged VLAN for end devices like PCs or NAS units that have no VLAN awareness.

Place Pi-hole in the Servers VLAN rather than the IoT VLAN. Add a firewall rule allowing DNS on port 53 from all VLANs to the Pi-hole IP, positioned before any rule blocking private address ranges.

Using the management VLAN as the native VLAN lets untagged traffic land in your management segment, enabling VLAN hopping attacks. Use a dedicated unused VLAN as native and keep management traffic tagged.