Setting up a VLAN

-

 


What follows is documentation for my home network VLAN configuration. An LLM was used to help with terminology. My focus is generally focused on the intent and sometimes that is misaligned with the common technical terms used to communicate some particular implementation. The machine is great at making that type of translation.

Why do you want a VLAN? 

 Unless you're well versed with layer 2 networking, setting up a VLAN network is quite a tedious, so there had better be a good reason to set this thing up. I have a few reasons:

Security: I'm interested in setting up various cheap IOT devices for home automation, but I don't trust them. Putting them on a separate VLAN minimizes how much damage can be done by a rogue device. 

Priority: I also have IP Cameras generating a lot of traffic. I'd like to see how much traffic and have a way to lower its priority.

More security: Any employer-managed device goes on a completely isolated network.

Fun: What can I say, I've always wanted to set this up. I worked at a networking lab for years and know how this stuff works in theory and am long overdue to see how it works in practice.

 Internet

Beginning from the Internet Service Provider (ISP), my public internet is delivered as light through a fiber optic cable. In order to avoid any potential issues with my ISPs troubleshooting flowchart, this entry point is completely standard and uses the provided hardware with minimal configuration: the provided Optical Network Terminal (ONT) to convert light over fiber signals to electricity over copper Ethernet wire, and the provided router with minimal configuration.

ISP Router

This is not a sophisticated router. It provides a Wi-Fi Access Point (AP) and a firewall with some basic security features. I simply disabled Wi-Fi and enabled the firewall to block incoming connections. This simplicity is very intentional. When my ISP goes down I simply patch my network out of the equation and let them fix the problem on their end.

OPNsense Firewall

Some background before jumping into this router's configuration. Since 2006 I've been running some variant of DD-WRT. In 2006 it was probably the original DD-WRT, later on I used Tomato, and most recently I was running Merlin on an Asus RT-AC68U. Originally I wanted to use these for a bridged routing feature that was not available on consumer routers at the time, later on I appreciated extra monitoring and plugin features. Custom firmware on these devices is not for the faint of heart: there is no support and every update has significant risk of bricking your router.

In early 2025, mainly for performance reasons, I switched to a mini PC running OPNsense. Finally, during my winter vacation in 2025-2026, I configured VLANs. 

Configuring the VLAN

Finally, the good stuff! Setting up a VLAN is a careful balance of designing the logical topology, mapping that design to the physical hardware and cabling, and configuring all of the components correctly.

Logical Topology

Like many VLANs, my goal is to partition traffic into broad categories:

  • USER (192.168.10.x) - trusted devices.
  • INFRA (192.168.20.x) - restricted access for network devices.
  • IOT (192.168.30.x) - locked down for untrusted IoT devices.
  • CAMERA (192.168.40.x) - locked down for untrusted IP Cameras and QoS.
  • WORK (192.168.50.x) - locked down for company managed devices.

 Physical Constraints

My network has networking "closets" connected in series. The main rack is located in the basement, everything that can go here is here. A single Ethernet cable runs to a central rack on the second floor connected to a managed switch. Finally, this managed switch connects to another manage switch in the annex rack.

The central and annex racks are configured with multiple VLANs, which means I need to use a trunking protocol. It also means I need to carefully configure each port to manage Tagged and Untagged traffic.

Hardware Availability

The last piece of the equation before getting into the physical layout and configuration is the available hardware. Each rack has a Managed Switch in order to configure traffic running across the trunk cables.

Notes on configuration order 

One extremely tedious part of this project is doing things in the right order. To configure managed switches, you need to connect to them, but once they're configured you need to use a specific port and/or a specific VLAN. This makes it incredibly easy to accidentally lose access to the configuration page. My suggestion: get familiar with the factory reset feature on your switch.

This goes for OPNsense as well, but because it's also a mini-PC you always have the monitor+keyboard fallback for settings recovery.

Hardware Configuration Overview

 In a VLAN network, every packet needs to be tagged. This can be done in many ways with varying levels of user convenience. The best way is to assign tags with a managed switch. At a high level, the switch will accept all incoming traffic on that port and insert a VLAN ID for all untagged traffic. Any traffic going in the other direction uses IP routing rules as usual (citation needed).

With that in mind, here is my network tree and how I've configured each port on each device. Each bullet is an Ethernet cable connected between two devices. Inside the square brackets is how the port is configured on the switch side:

main rack: 

  • ONT/ISP router
    • OPNsense firewall
      • [USER] server 
      • managed trunk switch
        • [INFRA] AP (Access VLAN: 10)
        • [WORK] keystone
        • [USER] dumb switch
          • keystone
          • TV 
        • Central trunk 
central rack: 
  • Central Trunk
    • Managed PoE switch
      • [IOT] Ziggbee Radio
      • [CAMERA] Dumb PoE switch
        • Camera 1
        • Camera 2
      • [INFRA] AP (Access VLAN: 10)
      • [INFRA] Annex Trunk

annex rack (not fully configured): 

  • [INFRA] Annex Trunk
    •  AP (Access VLAN: 10)

Software Configuration

 This is the part I should have written down in more detail 6 months ago! All of these configurations are made inside  OPNsense. To the best of my ability I'll describe the end-state configurations.

Interfaces > Assignments

 This is where you configure the physical interface. For my configuration, I created entries for WAN, TRUNK and Legacy. All VLAN traffic interfaces will be configured to use TRUNK.

Interfaces > Devices > VLAN 

Create an entry for each of your VLANs. My configuration includes TRUNK_USER, TRUNK_INFRA, TRUNK_IOT, etc. 

Services >  ISC DHCPv4 [legacy]

I don't recall seeing the legacy tag before, looks like I need to update my configuration to Kea DHCP. My original configuration probably used this in early 2025.

 For either approach: enable a DHCP server for all VLANs. OPNsense will route traffic according to the VLAN tags and provide addresses.

I took this one step further and configured static addresses by MAC address in the DHCP configurations. This was very convenient for the managed switches after factory resets.

Firewall

 Last but not least, you can finally configure the firewall! At this stage, you may treat each VLAN interface as if it were any other interface. OPNsense gives you many advanced features to work with, which ones you use depends entirely on your goals, so I recommend reading the docs.

Misc Details & Optimizations

 Cascading Firewalls: the ISP + OPNsense firewall configuration means that if you do want to allow traffic on some port, you need to configure it twice. Once in each router.

NAT Reflection: You might have some services running with a reverse proxy inside your network. This means your local service hosted at https://myservice.myproxy.com will leave your network before coming right back. Search for "nat reflection" to learn more, I opted for the settings at Services > Unbound DNS > Overrides.

Broadcast Discovery: there are an endless array of consumer devices (smart speakers, home assistants, tv streaming protocols) that use broadcast protocols for device discovery. This is a big problem if you put all of your devices on a separate VLAN from your user devices because those packets will never reach their intended recipient. There are ways to get them working (look up mDNS), but it's an endless game of cat and mouse. Take a long look in the mirror and decide if your principles are worth the hassle.

Custom cables: You need a lot of short cables to avoid creating a big mess in your networking closet. If you aren't already making your own cables, I'd suggest buying a few hundred feet of cat6, a bag of RJ45s and a crimping tool. 

 Next Steps

For my network, the next steps are mostly cosmetic. I'd like to get my switches and servers securely mounted to something. Probably a simple DIN rail with some 3D printed specialty mounts.

Conclusion

This was all setup about 6 months ago, since then I haven't done anything other than updating OPNsense. Overall I couldn't be happier. Everything works as it should, my network is safe, and it's still convenient enough to use that you wouldn't know it's there.




Comments

Post a Comment

Popular posts from this blog

Easy and accurate SVG to DXF conversion using Inkscape and pstoedit

-
If you've ever worked with a vector tool to design something to be carved with a CNC routing machine, you may have needed to convert the resulting SVG file into a DXF. In my workflow I often use Inkscape to generate my SVG graphic, but my CAD software is CamBam and it requires a DXF file. Many people have tried to make the perfect Inkscape plugin for exporting DXF, there is  Better DXF Export ,  Better Better DXF Export  and  Big Blue Saw's DXF Export . I've had the most luck with the last one, but it was still finicky and often broke when updating Inkscape or OSX. Not only that, but at the end of the Big Blue Saw page, Simon mentions that he doesn't even use the plugin most of the time, instead relying on a command line tool called pstoedit. With that in mind I made a small shell script which will convert an SVG file to DXF, you can save the script and run it directly or add the functions to your startup script. The script is available on github under the proj...
Read more

Terminal UI the Easy Way: BubbleTEA

-
Image
For the past 18 months I've been tinkering with a terminal application that serves as an Algorand node frontend. I had a number of requirements in mind when choosing the technology: a full screen terminal application, works over ssh, extensible to allow it to evolve with different utilities and views of the system over time, be programmed with the Go programming language.  In the past I've created these sorts of programs with bash, but it's not fun to manage terminal control characters and deal with re-drawing with bash. Using bash has always led my applications to be simplistic, typically never getting beyond simple spinners and progress bars. I knew about ncurses, but didn't want to lose the portability of bash -- some of these scripts were even POSIX compliant, and honestly I just didn't want to deal with low level interfaces and C bindings. Enter bubbletea . The team at Charm has built the tools I didn't even know I needed. There is an impressive array of d...
Read more

XCode4: UITabBarController with UINavigationController using Interface Builder

-
Image
If this helped you, please consider downloading my FREE  iPhone app " Hydrate Yourself "and leaving a review. There are a  whole   bunch  of  tutorials  to create a Navigation Controller inside a TabBarController with XCode3.  But there are a number of small changes in XCode4 which can trip up someone not familiar with them.  So this guide is essentially an updated version of those other guides, designed to create the same simple demo using the new tool. 1. Create a new Project We are going to start with a Tab Bar Application, so go ahead and create a new project as usual. I'm calling mine Navigation Tab Bar. 2. Select the Tab Bar Click MainWindow.xib and you should see the integrated Interface Builder. On the left is a section called Objects, select the Tab Bar Controller. 3. Add the Navigation Controller On the right side of your screen click the Utilities box. This is new in XCode4 and should look familiar if you've been...
Read more