Beginner’s Guide to VLANs in a Home Lab
Published · Last reviewed
A practical introduction to VLANs, subnets and segmentation for prosumer home labs.
VLANs sound like an enterprise feature, but they’re one of the simplest tools for cleaning up a home lab network. A VLAN is basically a virtual switch: devices on VLAN 10 can’t see devices on VLAN 20 unless a router or firewall allows it. You can run several of these VLANs over the same physical cables and switches, keeping traffic separated without buying more hardware.
The practical approach is to start with a small plan: one VLAN for your everyday devices, one for lab infrastructure, and one for untrusted IoT. Each VLAN gets its own subnet and DHCP scope. The router or gateway becomes the only path between them, and firewall rules on that device decide which flows are allowed. This alone stops a compromised camera from probing your hypervisor or development machines.
Configuration details vary by vendor, but the intent stays the same. On a prosumer switch or controller, you define VLAN IDs, tag the uplinks to your router as trunks, and assign access ports for clients. On wireless, each SSID can map to its own VLAN. Once this mapping is in place, you move a device into a different security zone just by changing its port or Wi-Fi network, not by rewriting your whole network.
An Example VLAN Plan
| VLAN ID | Name | Example subnet | Devices | Access |
|---|---|---|---|---|
| 10 | Trusted | 192.168.10.0/24 | Laptops, phones | Can reach Lab and IoT |
| 20 | Lab | 192.168.20.0/24 | Servers, hypervisors, NAS | Reachable from Trusted only |
| 30 | IoT | 192.168.30.0/24 | Cameras, smart plugs, TVs | Internet only |
| 40 | Guest | 192.168.40.0/24 | Visitors | Internet only |
Tagged vs. Untagged Ports
An untagged (access) port belongs to one VLAN and connects an ordinary device that knows nothing about VLANs. A tagged (trunk) port carries several VLANs at once, with each frame labeled by its VLAN ID. Trunks are used between switches, to access points and to the router.
Common Pitfalls
- Locking yourself out: Changing the VLAN of the port you are managing from can cut your connection. Make changes from a port that keeps its VLAN, and know how to reset the device.
- Discovery across VLANs: Casting, AirPlay and printer discovery rely on mDNS, which does not cross VLANs by default. Enable an mDNS reflector or keep those devices in the same VLAN as their users.
- DNS: If you run a local DNS server such as Pi-hole in one VLAN, add firewall rules that allow DNS (port 53) from the other VLANs.
- Hardware support: Unmanaged switches cannot assign ports to VLANs. You need a managed or “smart” switch.
Ready to set it up? Compare UniFi vs Omada gateways for VLAN-capable networks, or put your first VLAN to work with self-hosted Pi-hole DNS filtering.