Homelab Networking — VLANs, DNS, and Firewall Rules That Actually Work

A homelab without proper networking is just a pile of servers on a flat network where your IoT cameras can talk to your database and your guest Wi-Fi can reach your admin panel. That's not a lab — it's a liability.

I segmented my homelab into VLANs for trusted devices, IoT, guest access, and management traffic — with DNS that resolves internal services, firewall rules that enforce isolation, and Pi-hole filtering the whole network. This guide walks through building a network that's secure, fast, and doesn't require a $2000 enterprise switch.

What It Is

Network Design

The Core Problem: Flat Networks Are Dangerous

A flat network (everything on one subnet) means:

1. Any device can reach any other. Your $15 smart plug can scan your database server
2. No traffic filtering. A compromised IoT device becomes a pivot point into your entire network
3. No DNS control. Devices phone home to ad servers, tracking endpoints, and malware C2 servers
4. No performance isolation. A camera streaming 40 Mbps of video saturates your workstation's bandwidth

VLANs solve the segmentation problem. DNS filtering solves the privacy problem. Firewall rules solve the isolation problem.

Step 0 — Hardware

Minimum Stack

Why Managed Switch?

An unmanaged switch treats all ports the same — no VLAN support. A managed switch lets you: - Tag ports with VLAN IDs - Create VLAN trunks (carry multiple VLANs on one cable) - Set port-based access control

Step 1 — Router/Firewall (pfSense or OPNsense)

Install pfSense

1. Download ISO from pfsense.org
2. Flash to USB, boot, install to hard drive
3. Assign interfaces: WAN (Internet), LAN (Trusted VLAN)

Create VLANs on the Router

Interfaces → Assignments → VLANs

Assign VLAN Interfaces

Interfaces → Assignments

Firewall Rules

Firewall → Rules → VLAN 10 (IoT)

Firewall → Rules → VLAN 20 (Guest)

Firewall → Rules → VLAN 40 (Servers)

Step 2 — Managed Switch Configuration

Create VLANs on the Switch

Switch Settings → VLANs

Port Assignment

Trunk Port (Port 1 to Router)

The trunk port carries all VLANs between the switch and router:

Port 1: Mode=Trunk, PVID=1, Tagged=10,20,30,40

Step 3 — Pi-hole (DNS Filtering)

Install Pi-hole

# On a Raspberry Pi or Docker host
curl -sSL https://install.pi-hole.net | bash

# Or with Docker
docker run -d \
  --name pihole \
  -p 53:53/tcp -p 53:53/udp \
  -p 8053:80 \
  -e TZ=America/New_York \
  -e WEBPASSWORD=your_admin_password \
  -v pihole:/etc/pihole \
  --restart unless-stopped \
  pihole/pihole:latest

Configure Pi-hole

1. Open http://PIHOLE_IP/admin
2. Settings → DNS:
3. Upstream DNS: Cloudflare (1.1.1.1) + Google (8.8.8.8)
4. Enable conditional forwarding for local domains

Block Lists

Add these block lists:

DNS Records for Internal Services

Local DNS → DNS Records

Step 4 — Inter-VLAN Routing Rules

Default Rules

Specific Use Cases

Step 5 — Wireless Configuration

SSID → VLAN Mapping

Ubiquiti AP Config

Settings → WiFi → Create New Network

Network: HomeWiFi
VLAN: 1 (or untagged for default)
Security: WPA3-Personal

Network: HomeWiFi_IoT
VLAN: 10
Security: WPA2-Personal

Network: HomeWiFi_Guest
VLAN: 20
Security: WPA2-Personal
Guest Hotspot: Enabled

Step 6 — Verification

Test VLAN Isolation

# From Trusted VLAN (192.168.1.x):
ping 192.168.10.1    # Should work (router)
ping 192.168.10.30   # Should fail (IoT blocked)
ping 192.168.40.10   # Should work (NAS)

# From IoT VLAN (192.168.10.x):
ping 192.168.1.1     # Should fail (Trusted blocked)
ping 192.168.1.10    # Should fail (workstation blocked)
ping 8.8.8.8         # Should work (Internet)

Test DNS Filtering

# From any device:
nslookup ads.google.com
# Should return 0.0.0.0 (blocked)

nslookup google.com
# Should return real IP (allowed)

nslookup nas.local
# Should return 192.168.40.10 (local DNS)

What I'd Tell Anyone Building One

1. Start with VLANs, not firewalls. VLANs give you 80% of the security benefit with 20% of the complexity. A managed switch and router with VLAN support is enough — you can add firewall rules later.

2. Block IoT from the start. Every IoT device is a potential attack vector. Put them on a separate VLAN and block all RFC1918 traffic. If they need to reach a specific internal service, add a single allow rule.

3. Pi-hole is the best $0 investment. It blocks ads, trackers, and malware domains for every device on your network. No client-side software needed — just point DNS to Pi-hole.

4. Use conditional forwarding for local domains. Without it, Pi-hole can't resolve nas.local because it forwards to Cloudflare. Enable Settings → DNS → "Use conditional forwarding" and point to your router's IP.

5. Don't over-segment. Four VLANs (Trusted, IoT, Guest, Servers) covers 99% of homelab needs. More VLANs mean more firewall rules to manage and more things that can break.

6. Label your ports. When you're debugging connectivity at 11 PM, you don't want to trace cables. Use a label maker or colored cables to identify VLANs.

Get It

• pfSense: pfsense.org
• OPNsense: opnsense.org
• Pi-hole: pi-hole.net
• AdGuard Home: adguard.com/adguard-home
• Ubiquiti: ui.com

Last updated: 2026-09-01 — Tested with Ubiquiti USG + USW-Lite-16-PoE + U6 Lite, Pi-hole v6, pfSense 2.7.