Home-lab networking: VLANs, firewall, and isolation

Why segment your home lab?

A flat home network is fine until your tinkering breaks something. VLAN segmentation gives you:

• Blast radius — a misbehaving VM on the “lab” VLAN can’t bring down your partner’s Netflix stream
• Security — exposed services live on a different VLAN with a different firewall policy
• Test realism — production networks are segmented; learn how now

The price is complexity: a managed switch, a router/firewall (often a VM), and VLAN tags on every interface. For a home lab, the complexity is worth it.

VLAN design for a home lab

A common home-lab VLAN scheme:

flowchart LR
  Internet([internet]) --> Router[OpnSense VM<br/>VLAN-aware router<br/>192.168.10.1]
  Router -->|trunk<br/>VLAN 10,20,30,40| Switch[Managed switch]
  Switch -->|VLAN 10<br/>mgmt| Mgmt[Proxmox mgmt<br/>iLO/iDRAC]
  Switch -->|VLAN 20<br/>lab| Lab[Lab VMs<br/>192.168.20.0/24]
  Switch -->|VLAN 30<br/>iot| IoT[IoT devices<br/>192.168.30.0/24]
  Switch -->|VLAN 40<br/>guest| Guest[Guest WiFi<br/>192.168.40.0/24]

The “trunk” VLAN carries all other VLANs as 802.1Q tags between the router and switch. Your laptop, on VLAN 20, only sees the lab subnet; your guest devices only see VLAN 40.

Hardware requirements

• Managed switch with 802.1Q support — TP-Link TL-SG108E ($50), Netgear GS108T, Mikrotik, etc.
• Router/firewall with VLAN support — your ISP router may not do this. Use OpnSense or pfSense in a VM.
• NIC on Proxmox host that supports VLAN tagging — basically any modern NIC does

Step 1: Configure the managed switch

This is vendor-specific but the pattern is:

• Default VLAN (PVID) on ports to your “trusted” devices (laptop, Proxmox mgmt) = VLAN 10
• Trunk port to your router/firewall — carries all VLANs
• Trunk port to your Proxmox host — carries VLANs 10 and 20
• WiFi AP on VLAN 40 (guest) or VLAN 20 (trusted) — depends on your AP config

Step 2: Set up OpnSense as a VM router

OpnSense is a FreeBSD-based firewall with great VLAN support. Run it as a VM on your Proxmox host.

# Create the OpnSense VM
qm create 130 --name opnsense --memory 2048 --cores 2 \
  --net0 virtio,bridge=vmbr0,tag=99      # WAN: trunk port, untagged on WAN side
  --net1 virtio,bridge=vmbr0,tag=10     # MGMT: VLAN 10
  --net2 virtio,bridge=vmbr0,tag=20     # LAB: VLAN 20
  --net3 virtio,bridge=vmbr0,tag=30     # IOT: VLAN 30
  --net4 virtio,bridge=vmbr0,tag=40     # GUEST: VLAN 40
  --scsihw virtio-scsi-single \
  --scsi0 local-lvm:16,iothread=1 \
  --ide2 local:iso/opnsense-24.7.iso,media=cdrom \
  --boot order=scsi0 --ostype l26

Inside OpnSense

1. Boot the VM, install OpnSense
2. Assign interfaces:
   • vtnet0 = WAN (DHCP from your ISP router, or static)
   • vtnet1 = MGMT (192.168.10.1/24)
   • vtnet2 = LAB (192.168.20.1/24)
   • vtnet3 = IOT (192.168.30.1/24)
   • vtnet4 = GUEST (192.168.40.1/24)
3. Enable DHCP on each LAN interface
4. Configure firewall rules — see below

Step 3: Firewall rules — the minimum

OpnSense rules are evaluated top-to-bottom, first match wins.

flowchart LR
  MGMT[VLAN 10<br/>mgmt] -->|full access| ALL((any))
  LAB[VLAN 20<br/>lab] -->|TCP/UDP| WAN((WAN))
  LAB -.->|blocked| MGMT
  LAB -.->|blocked| IOT
  LAB -.->|blocked| GUEST
  IOT[VLAN 30<br/>iot] -->|DNS only| WAN
  GUEST[VLAN 40<br/>guest] -->|DNS/HTTP/HTTPS| WAN

# Default policies: deny all between VLANs, allow outbound to WAN

# MGMT → any (admin access)
pass in on vtnet1 proto \{ tcp udp icmp \} to any

# LAB → WAN (lab VMs need internet)
pass in on vtnet2 proto \{ tcp udp \} to vtnet0
block in on vtnet2 to vtnet1     # lab cannot reach mgmt
block in on vtnet2 to vtnet3     # lab cannot reach iot
block in on vtnet2 to vtnet4     # lab cannot reach guest

# IOT → WAN only (smart home devices)
pass in on vtnet3 proto \{ tcp udp \} to vtnet0 port 53    # DNS only
# No other IOT rules — fully isolated

# GUEST → WAN only
pass in on vtnet4 proto \{ tcp udp \} to vtnet0 port 53
pass in on vtnet4 proto \{ tcp udp \} to vtnet0 port 80
pass in on vtnet4 proto \{ tcp udp \} to vtnet0 port 443

Step 4: Configure VMs to use OpnSense as gateway

In Proxmox, when you create a VM/LXC, set its gateway to the OpnSense LAN IP for that VLAN.

# A VM on the LAB VLAN
qm set 100 --net0 virtio,bridge=vmbr0,tag=20
# Inside the VM: ip=192.168.20.50/24, gw=192.168.20.1

# Or via cloud-init
qm set 100 --ipconfig0 ip=192.168.20.50/24,gw=192.168.20.1

Step 5: Proxmox firewall (belt and suspenders)

Proxmox has its own firewall that runs at the VM/LXC level. Use it as a second layer.

# Enable the firewall at the cluster level
# Datacenter → Firewall → Options → Firewall: Yes

# Per-VM rules (via UI or CLI)
# VM 100: allow SSH from mgmt only
pve-firewall localnet add 100 -i 0 -d 192.168.10.0/24 -p tcp --dport 22 -j ACCEPT
pve-firewall localnet add 100 -i 0 -j DROP

Common pitfalls

Asymmetric routing

If VM-A (VLAN 20) talks to VM-B (VLAN 20) directly through the bridge, but their gateway is OpnSense, traffic goes VM-A → OpnSense → VM-B → OpnSense → VM-A. The reply path doesn’t match the request path → firewall confusion → broken connections.

Fix: ensure intra-VLAN traffic stays on the bridge. Proxmox’s bridge with VLAN tags handles this correctly; just don’t add weird routes.

Native VLAN mismatch

If your switch’s “native VLAN” (untagged traffic on a trunk) doesn’t match Proxmox’s expectations, you’ll see weird drops. Convention: native VLAN = 99 (or whatever your “trunk-only” VLAN is), and all traffic is tagged.

DNS leaks

If you put Pi-hole on VLAN 20 (LAB), but your guest VLAN uses the ISP router’s DNS, Pi-hole only filters your trusted devices. Either put Pi-hole on every VLAN or use a centralised DNS via OpnSense’s DNS resolver.

MTU issues

VLAN tagging adds 4 bytes to each frame. If your jumbo frames are at exactly 9000, VLAN-tagged frames become 9004 — too big for some switches. Drop to 1500 standard or use 9004 with care.

Putting it together: a day-1 home lab VLAN config

If you’re starting from scratch:

1. Buy a managed switch (TP-Link TL-SG108E, $50)
2. Install OpnSense as a VM with one WAN and multiple VLAN interfaces
3. Configure switch ports: trunk to OpnSense VM, trunk to Proxmox host, untagged on VLAN 20 for your laptop
4. Configure Proxmox with vmbr0 as VLAN-aware bridge
5. Create VMs on different VLANs by setting tag= on their NICs
6. Tighten firewall rules starting from “deny all”
7. Add exceptions as needed

This setup runs reliably for years with minimal maintenance.

Key takeaways

• VLAN segmentation protects your production traffic from your lab tinkering
• OpnSense (or pfSense) as a VM gives you a powerful firewall without dedicated hardware
• The Proxmox firewall adds another layer of defence
• Start restrictive, relax as needed — never the other way around
• Watch out for asymmetric routing, native VLAN mismatches, DNS leaks, and MTU

Knowledge check