A secure home network with VLANs is no longer only a lab topic. A 2.5 Gb/s Internet line, several Wi-Fi 6E or Wi-Fi 7 access points, cameras, smart TVs, work laptops and a small NAS can quickly become a flat network where every device can see everything else. That is convenient until one cheap IoT device, compromised camera or infected family laptop reaches your work machine or backup storage.
This guide uses a concrete scenario: a 200 m² home or small office with 2 adults working remotely, 1 NAS, 4 cameras, 2 access points, 25-40 client devices and a budget between $750 and $2,500. The goal is not a perfect enterprise design. The goal is a practical design you can buy, configure and verify.
Problem: the flat network is the real risk
Most home routers put wired clients, Wi-Fi clients, printers, cameras, TVs and the NAS into one subnet, often something like 192.168.1.0/24. That means a compromised device can scan the whole house, try SMB against the NAS, open printer admin pages, or discover work laptops with mDNS and NetBIOS. If remote work, accounting data, family photos and surveillance recordings live on the same broadcast domain, your weakest device becomes the path to your most valuable data.
The symptoms are easy to miss: cameras work, Netflix works, Wi-Fi is fast enough, and the NAS is visible everywhere. The design fails only when something bad happens or when you need to prove that backups, cameras and work devices are isolated.
Diagnosis: what should be separated?
Start with asset groups, not brands. For this scenario I would split the network into five zones:
| VLAN | Subnet | Purpose | Default policy |
|---|---|---|---|
| 10 | 192.168.10.0/24 | Trusted laptops, phones, admin workstation | Can reach Internet, printer, NAS services |
| 20 | 192.168.20.0/24 | IoT: TVs, speakers, assistants, smart plugs | Internet only, no access to trusted VLAN |
| 30 | 192.168.30.0/24 | Cameras and NVR | Cameras to NVR only; NVR to Internet only if required |
| 40 | 192.168.40.0/24 | Guest Wi-Fi | Internet only, client isolation enabled |
| 50 | 192.168.50.0/24 | NAS and backup target | Only explicit ports from trusted clients and backup jobs |
| 99 | 192.168.99.0/24 | Network management | Only admin workstation can reach device UI/SSH |
This is the important design choice: the firewall should route between VLANs, and every cross-VLAN flow should be intentional. Do not rely on Wi-Fi passwords as your segmentation model.
Practical topology
Design options: UniFi, MikroTik or OPNsense/pfSense?
UniFi is usually the easiest path when you want a clean controller, Wi-Fi, switching, guest portal and simple firewall policies in one interface. It is a good choice for a home office where the owner wants visibility without living in the CLI. A UniFi Cloud Gateway Max, UDM Pro or UDM SE with UniFi switches and APs can cover most homes and small offices.
MikroTik gives excellent routing value and deep control for the price. It is attractive if you are comfortable with RouterOS, want WireGuard, BGP/OSPF labs, policy routing, or a low-cost 10 GbE edge. The trade-off is that Wi-Fi and switching design can require more care, especially if you mix CAPsMAN, bridge VLAN filtering and hardware offload.
OPNsense or pfSense is the flexible firewall option. Use it when you want strong firewalling, VPN, IDS/IPS packages, detailed logging and hardware choice. Pair it with a managed PoE switch and separate APs. For 2.5 Gb/s Internet, choose hardware with enough CPU and Intel i226/i225 or SFP+ ports; do not assume an old mini-PC can route, inspect and VPN at line rate.
Practical configuration checklist
- Create VLAN interfaces on the firewall: VLAN 10, 20, 30, 40, 50 and 99.
- Enable DHCP per VLAN with clear ranges, for example 192.168.10.100-199 for clients and static reservations for infrastructure.
- Configure the switch uplink to the firewall as an 802.1Q trunk carrying all VLANs.
- Configure AP switch ports as trunks carrying VLAN 10, 20 and 40. Map SSIDs to the correct VLANs: "Home" to 10, "IoT" to 20, "Guest" to 40.
- Put cameras on access ports in VLAN 30. Put the NAS on VLAN 50. Put switch, AP and firewall management addresses in VLAN 99.
- Start with inter-VLAN deny by default. Then add only required allows.
Example firewall policy:
- VLAN 10 to Internet: allow.
- VLAN 10 to NAS VLAN 50: allow TCP 445/SMB only from trusted clients, or prefer HTTPS backup/application ports if possible.
- VLAN 10 admin workstation to VLAN 99: allow HTTPS/SSH/SNMP.
- VLAN 20 IoT to Internet: allow DNS/NTP/HTTPS as needed; block RFC1918 private networks.
- VLAN 30 cameras to NVR: allow camera protocols only; block cameras from initiating access to laptops and NAS.
- VLAN 40 guests to Internet: allow; block all private networks; enable wireless client isolation.
Verification and troubleshooting
Do not call the job finished when the Wi-Fi connects. Build a small reachability matrix and test it from real clients:
| Test | Expected result | Tool |
|---|---|---|
| Guest client to NAS 192.168.50.10 | Blocked | ping, browser, firewall log |
| IoT TV to laptop VLAN 10 | Blocked | ping or TCP test |
| Trusted laptop to NAS SMB | Allowed only from trusted devices | SMB mount, firewall log |
| Camera to NVR | Allowed | NVR stream status |
| Admin PC to switch/AP UI | Allowed | HTTPS/SSH |
| IoT/guest DNS | Allowed only to approved resolver | nslookup/dig |
For performance, run iperf3 between a wired client and the NAS. A healthy 1 GbE client should typically show around 930-950 Mb/s TCP throughput. A healthy 2.5 GbE path often lands around 2.3 Gb/s. For 10 GbE, expect roughly 9.3-9.8 Gb/s with the right NIC, driver, MTU and storage. If throughput is low, check link speed negotiation, bad patch cables, switch port errors, CPU load on the firewall and whether traffic is being unnecessarily routed through IDS/IPS.
For packet loss, run a long ping from each VLAN to the firewall gateway and to a stable Internet target. If only Wi-Fi clients lose packets, investigate channel width, RSSI, DFS events and roaming. If wired clients lose packets, check switch counters, cabling and duplex/link speed.
Neutral shopping list / bill of materials
Choose the platform first, then buy around it. A realistic secure home or small-office build often looks like this:
- Budget around $750: 2.5 GbE-capable firewall/router, 8-port managed PoE switch, one Wi-Fi 6 AP, small UPS, patch cables and labels. Good for apartments or small homes.
- Budget around $1,500: stronger firewall or UniFi gateway, 16-port PoE switch with a few 2.5 GbE ports, two Wi-Fi 6E/7 APs, rack shelf or small wall cabinet, UPS and a basic cable tester.
- Budget around $2,500: UDM Pro/SE, OPNsense appliance or MikroTik CCR/CRS combination, 24-port PoE switch, 10 GbE/SFP+ uplink to NAS, two or three APs, rack UPS, patch panel and monitoring sensor.
Useful items that are easy to forget: short DAC cable for SFP+ links, Cat 6A patch cables for 10GBase-T, spare PoE budget for cameras, a UPS with enough runtime for firewall + switch + ONT, and labels for every patch panel port.
Common mistakes
- Creating VLANs on the switch but not on the firewall, so routing and DHCP never work.
- Putting AP management and client SSIDs in the same VLAN.
- Allowing "IoT to any" because one device discovery feature broke. Fix discovery deliberately with mDNS reflection or a specific allow rule.
- Using the NAS as both general file share and backup target without restricting who can reach backup repositories.
- Buying 2.5 GbE or 10 GbE hardware without checking whether the firewall can inspect traffic at that speed.
Related reading
- Start Here: Networking Topics
- About Network freak
- Firewall articles
- VLAN articles
- Home Network articles
- Management Plane Security: Practical Guide for Network Engineers
Final recommendation
If you want the simplest managed experience, choose UniFi and keep the design clean. If you want maximum routing value and do not mind the learning curve, choose MikroTik. If you want firewall depth and logging, use OPNsense or pfSense with a managed switch and separate APs. In every case, the winning design is the same: trusted devices, IoT, cameras, guests, NAS and management should not live in one flat subnet.
If you are building a similar home office or small-business network, leave a comment with your Internet speed, number of APs, switch model and the devices you want to isolate. I can suggest a practical VLAN layout and verification checklist.
Post a Comment