Instruction 01-vlan-design-for-a-homelab: Reading

A VLAN is a Layer 2 boundary, not a complete security control. Hosts in different VLANs require a Layer 3 device to communicate, but meaningful isolation exists only when that device enforces an explicit policy. Begin by grouping systems according to trust and function rather than placing every device in one large subnet. This design uses management, infrastructure, lab, guest, and IoT zones. Management is reserved for authorized administration clients. Infrastructure contains shared servers. Lab contains experimental workloads. Guest and IoT devices are treated as untrusted. Each routed VLAN receives a unique subnet and gateway, while VLAN 999 is an unrouted blackhole VLAN used only for unused or untagged-port handling.

An access port should have one untagged VLAN and a matching PVID. A trunk should carry only the tagged VLANs required by the attached device. Do not automatically place the management VLAN on every hypervisor trunk. In this worked design, core-02 carries tagged VLAN 10 because the hypervisor host has an explicitly documented management interface in VLAN 10. It also carries VLANs 20 and 30 for infrastructure and lab workloads. It deliberately omits VLANs 40 and 50 because this host does not run guest or IoT workloads. If host management used a separate physical access port, VLAN 10 should be removed from the workload trunk. The access-point trunk carries VLANs 40 and 50 for wireless client networks and VLAN 10 only because the access point itself has a tagged management interface there.

Policy design starts with required flows, not broad statements such as allow internal or allow selected. Every policy row must name a defined source, a defined destination, a protocol, destination ports, an action, and a purpose. Client zones need DHCP for addressing, DNS for name resolution, and NTP for time synchronization. This model represents those shared gateway-hosted services with the defined destination gateway_services. The internet destination is also explicitly defined. Management receives narrowly scoped administrative access to infrastructure and IoT HTTPS interfaces. Lab, guest, and IoT may use specified internet services but are explicitly denied access to other internal zones. A default-deny policy covers traffic not listed.

Trunk allowlists reduce accidental exposure and limit the impact of mistakes. A trunk carrying every VLAN defeats that goal even if routing rules are otherwise correct. Untagged traffic on trunks is mapped to VLAN 999, which has no gateway or SVI. This helps reduce native-VLAN ambiguity, but it does not replace other controls. Disable dynamic trunk negotiation where supported, avoid using the native VLAN for user or management traffic, and keep native-VLAN behavior consistent at both ends. These practices help mitigate VLAN hopping, including double-tagging scenarios. Unused switch ports must not merely be assigned to VLAN 999; they must also be administratively disabled. Finally, treat the generated plan as vendor-neutral intent. Validate it, review it, and only then translate it into syntax appropriate for the actual switch, router, hypervisor, and access point.