homelab-vlan-segmentation
Segments home networks into VLANs for different traffic types using common equipment.
What it does
This guide teaches you how to split your home network into 'VLANs,' which are like separate virtual networks within the same physical network. This helps improve security by isolating devices like smart cameras and guest networks so they can't access your computers or servers.
When to use it
- ✓When setting up a home network for the first time.
- ✓To isolate 'Internet of Things' (IoT) devices.
- ✓To create a separate Wi-Fi network for guests.
Example of what to ask your AI
“How can I segment my home network so IoT devices can't access my computers?”
Want more? Open the sections below.
How to use
The easiest way: copy the message below and paste it into Claude, ChatGPT, Cursor or any AI. It reads the skill and follows the instructions.
Skill link
Ready-to-paste message
How it works
It explains how to create different virtual networks (VLANs) and set up firewall rules to control which device can talk to which. This is done on network equipment like UniFi, pfSense/OPNsense, or MikroTik.
Installation
Easiest way: copy the skill link and paste it into Claude, ChatGPT or Cursor asking it to follow the instructions.
In the terminal (Claude Code, Codex, Cursor), in your project folder:
npx skills add affaan-m/ECC --skill homelab-vlan-segmentationOr download just the file:
curl -L https://raw.githubusercontent.com/affaan-m/ECC/main/skills/homelab-vlan-segmentation/SKILL.md -o SKILL.mdTechnical content (original SKILL.md)
Original text by the author, straight from GitHub.
Homelab VLAN Segmentation
How to split a home network into isolated VLANs so IoT devices, guests, and your main PCs cannot talk to each other. The most impactful security upgrade for a home network.
All firewall rules shown here add isolation between segments — they do not remove existing protections. Apply changes in a maintenance window and verify connectivity between segments after each step before moving on.
When to Use
- Setting up VLANs on a home network for the first time
- Isolating IoT devices (smart bulbs, cameras, TVs) from trusted devices
- Creating a guest Wi-Fi network that cannot reach home devices
- Explaining how VLANs work to someone unfamiliar with the concept
- Configuring trunk ports, access ports, and SSID-to-VLAN mapping
- Troubleshooting inter-VLAN routing or firewall rule issues on pfSense/OPNsense/UniFi
How It Works
Without VLANs — flat network:
All devices on 192.168.1.0/24
Smart TV (potential malware) → can reach your NAS, PCs, everything
With VLANs:
VLAN 10 — Trusted 192.168.10.0/24 (PCs, phones, laptops)
VLAN 20 — IoT 192.168.20.0/24 (smart TV, bulbs, cameras)
VLAN 30 — Servers 192.168.30.0/24 (NAS, Pi, VMs)
VLAN 40 — Guest 192.168.40.0/24 (visitor Wi-Fi)
VLAN 99 — Management 192.168.99.0/24 (switch/AP web UIs)
Smart TV → blocked from reaching 192.168.10.0/24 and 192.168.30.0/24
Guests → internet only, cannot see any home devices
VLAN Design Template
VLAN Name Subnet Gateway Purpose
10 trusted 192.168.10.0/24 192.168.10.1 PCs, phones, laptops
20 iot 192.168.20.0/24 192.168.20.1 Smart home devices
30 servers 192.168.30.0/24 192.168.30.1 NAS, Pi, self-hosted
40 guest 192.168.40.0/24 192.168.40.1 Visitor Wi-Fi
99 management 192.168.99.0/24 192.168.99.1 Network gear web UIs
Examples
Typical homelab with UniFi AP and managed switch:
Scenario: 3-bedroom house, UniFi Dream Machine + UniFi 8-port switch + 2 APs
VLAN 10 — Trusted 192.168.10.0/24 MacBook, iPhones, iPad
VLAN 20 — IoT 192.168.20.0/24 Nest thermostat, Philips Hue, Ring doorbell, smart TVs
VLAN 30 — Servers 192.168.30.0/24 Synology NAS (192.168.30.10), Pi-hole (192.168.30.2)
VLAN 40 — Guest 192.168.40.0/24 Visitor Wi-Fi — internet only
SSID → VLAN mapping:
"Home" → VLAN 10 (WPA2, strong password, trusted devices only)
"IoT" → VLAN 20 (WPA2, separate password, printed on router for setup)
"Guest" → VLAN 40 (WPA2, simple password you can share freely)
Switch port behavior:
Port 1 → trunk to router (tagged VLANs 10,20,30,40,99)
Port 2 → trunk to APs (tagged VLANs 10,20,40; AP handles per-SSID tagging)
Port 3 → access VLAN 30 (NAS — untagged, no VLAN awareness needed)
Port 4 → access VLAN 30 (Pi-hole — untagged)
Port 5–8 → access VLAN 10 (wired workstations)
Firewall rules applied (all rules add isolation, none remove existing protections):
IoT → Trusted: BLOCK
IoT → Servers: BLOCK except 192.168.30.2:53 (Pi-hole DNS allowed)
IoT → Internet: ALLOW
Guest → Local networks: BLOCK
Guest → Internet: ALLOW
Trusted → everywhere: ALLOW
UniFi Configuration
Create Networks in UniFi Controller
Settings → Networks → Create New Network
For each VLAN:
Name: IoT
Purpose: Corporate (gives DHCP + routing)
VLAN ID: 20
Network: 192.168.20.0/24
Gateway IP: 192.168.20.1
DHCP: Enable
DHCP Range: 192.168.20.100 – 192.168.20.254
Map SSIDs to VLANs (UniFi)
Settings → WiFi → Create New WiFi
Name: IoT-Network
Password: <separate password>
Network: IoT ← select your VLAN here
# All devices connecting to this SSID land in VLAN 20
Name: Guest
Password: <guest password>
Network: Guest
Guest Policy: Enable ← isolates guests from each other too
UniFi Firewall Rules (Traffic Rules)
Settings → Traffic & Security → Traffic Rules
# Block IoT from reaching Trusted VLAN
Action: Block
Category: Local Network
Source: IoT (192.168.20.0/24)
Destination: Trusted (192.168.10.0/24)
# Allow IoT to reach internet only
Action: Allow
Source: IoT
Destination: Internet
# Block Guest from all local networks
Action: Block
Source: Guest
Destination: Local Networks
pfSense / OPNsense Configuration
Create VLANs
Interfaces → Assignments → VLANs → Add
Parent Interface: em1 (your LAN NIC)
VLAN Tag: 20
…
FAQ
What is a VLAN?
A VLAN (Virtual Local Area Network) is like creating multiple smaller, isolated networks within a single physical network. It helps organize and secure your devices.
Why should I use VLANs?
VLANs enhance security by preventing less trusted devices (like smart cameras or guest devices) from accessing your computers or important data.
Do I need special equipment to use VLANs?
Yes, you generally need a router and switches that support VLANs, such as those mentioned in the guide (UniFi, pfSense/OPNsense, MikroTik).
Details
Original description by the author
Segmenting home networks into VLANs for IoT, guest, trusted, and server traffic using UniFi, pfSense/OPNsense, and MikroTik — including switch trunk config, firewall rules, and wireless SSID mapping. Use when splitting a home network into IoT, guest, trusted, and server VLANs on UniFi, pfSense/OPNsense, or MikroTik.
repo: affaan-m/ECC
Popularity
- GitHub stars
- 280k
- Ranking position
- #209
- License
- MIT
- Updated
- 10/15/2026
Comments
- …
More skills from this repository
accessibility
Helps your agent create interfaces that everyone can use. Ensures websites and apps work well for people with disabilities, like those who are blind or have reduced mobility.
affaan-m/ECC
agent-architecture-audit
Makes your agent check if everything is working correctly. It finds and fixes problems in AI systems, ensuring they perform as expected.
affaan-m/ECC
agent-eval
Helps your agent compare different AI coding tools. It measures which one is faster, cheaper, and more reliable for specific tasks.
affaan-m/ECC
agent-harness-construction
Makes your agent better understand how to perform tasks. It optimizes the tools and instructions the agent uses to increase its chances of success.
affaan-m/ECC
Similar skills
template-skill
This is a generic template for new skills. It needs a specific description to be useful.
anthropics/skills
shipping-and-launch
Prepares your code to be safely launched into production. Helps ensure everything is ready, monitored, and has a rollback plan.
addyosmani/agent-skills
using-agent-skills
Has your agent discover and use other skills. It's useful for deciding which tool or workflow to use for a specific task.
addyosmani/agent-skills