A practical introduction to VLANs, subnets and segmentation for prosumer home labs.
VLANs sound like an enterprise feature, but they’re one of the simplest tools for cleaning up a home lab network. A VLAN is basically a virtual switch: devices on VLAN 10 can’t see devices on VLAN 20 unless a router or firewall allows it. You can run several of these VLANs over the same physical cables and switches, keeping traffic separated without buying more hardware.
The practical approach is to start with a small plan: one VLAN for your everyday devices, one for lab infrastructure, and one for untrusted IoT. Each VLAN gets its own subnet and DHCP scope. The router or gateway becomes the only path between them, and firewall rules on that device decide which flows are allowed. This alone stops a compromised camera from probing your hypervisor or development machines.
Configuration details vary by vendor, but the intent stays the same. On a prosumer switch or controller, you define VLAN IDs, tag the uplinks to your router as trunks, and assign access ports for clients. On wireless, each SSID can map to its own VLAN. Once this mapping is in place, you move a device into a different security zone just by changing its port or Wi-Fi network, not by rewriting your whole network.