• Notes
  VLANs

• PostedOct 6, 2026
• Reading time3 min

• A friend asked me how to start segmenting their home network. Here is the short version I gave them.

  Start with three

  Trusted, IoT, and Guest is enough. Add more only when you have a reason.

  Default deny

  Let each VLAN reach the internet and nothing else. Then open specific holes one at a time, such as letting Trusted reach the printer, and write down why.

  Mind the mDNS

  AirPlay, printers, and casting all rely on multicast discovery, which stops at the VLAN boundary. An mDNS reflector on the firewall fixes it without opening everything up.

  My own layout is on the Homelab Rebuild page if you want a template.

Thanks for reading.