← All Articles

How to Set Up VLANs in a Homelab: Isolate IoT on a $25 Switch

Set up homelab VLANs on a $25 managed switch: tag VLANs, configure trunk ports, route between networks, and isolate untrusted IoT devices. Exact config included.

Budget Homelab ·
networkingvlansbeginner

This post contains affiliate links. If you buy through them, I earn a small commission at no extra cost to you.

Most homelab guides skip the network setup. They assume you’ll plug everything into the same switch your router came with and call it a day. For a basic setup, that works fine. But as soon as you start adding IoT devices, untrusted services, or anything you’re experimenting with, sharing a flat network with the rest of your house becomes a problem worth solving.

VLANs fix this. They’re not complicated once you understand what they’re actually doing, but the terminology and marketing around managed switches makes the whole thing seem harder than it is.

This is the networking setup I run, explained from the beginning.

Quick Answer: How to Set Up VLANs in a Homelab

To set up VLANs in a homelab you need one managed switch plus a router or firewall that can route between networks. Five steps:

  1. Get a managed switch that supports 802.1Q VLAN tagging. The TP-Link TL-SG108E (about $25) is the standard budget pick.
  2. Define your VLANs. A common layout is VLAN 10 Trusted, VLAN 20 Homelab, VLAN 30 IoT, and VLAN 40 Guest.
  3. Assign access ports so each device’s port carries a single VLAN and only sees that network.
  4. Configure a trunk port on the uplink to your router so one cable carries every VLAN tag.
  5. Write firewall rules on your router to control exactly which VLANs can reach each other.

The rest of this guide explains each step in detail, including the exact switch config and firewall rules.

What a VLAN Actually Is

A VLAN (Virtual LAN) is a way to divide a single physical network into multiple isolated logical networks. Devices on different VLANs cannot communicate with each other by default, even if they’re plugged into the same physical switch.

Without VLANs, your network is flat: every device can reach every other device. Your phone, your laptop, your smart TV, your homelab server, that one cheap IoT plug you bought: all on the same network, all able to attempt connections to each other.

With VLANs, you can separate traffic:

Traffic between VLANs can only flow through your router (or firewall), which means you control exactly what can talk to what.

Why This Matters for Homelabs

VLANs isolate homelab devices by putting each device group on its own logical network, so a compromised IoT gadget or a broken experiment can’t reach your NAS, server, or laptops. Traffic between VLANs only passes through your router’s firewall rules, which means nothing crosses between groups unless you explicitly allow it.

Two reasons.

IoT devices are a security problem. Cheap IoT hardware often has poor firmware security, ships with known vulnerabilities, and gets infrequent updates (or no updates). If a smart camera or thermostat on your network gets compromised, on a flat network it has a clear path to everything else: your NAS, your server, your laptops. On a VLAN-segregated network, a compromised IoT device can reach the internet but can’t reach your homelab.

Homelab experiments shouldn’t touch production. When you’re learning, you’re running things you don’t fully understand yet. A misconfigured service, an exposed port, a container with an old image: isolating your homelab traffic means an experiment gone wrong can’t directly affect your household’s devices.

Neither of these concerns requires complex enterprise networking to address. Basic segmentation with a $25 managed switch handles both. The homelab security basics guide covers the full picture. VLANs are one layer of a broader approach that also includes keeping services off the public internet and hardening SSH access.

How to Connect Multiple VLANs in a Homelab

To connect multiple VLANs in a homelab, route between them through your router or firewall over a single trunk port on your managed switch. Each device sits on an access port assigned to one VLAN, the switch’s uplink is a trunk port that carries every VLAN’s tagged traffic to the router over one cable, and the router’s firewall rules decide which VLANs are allowed to reach each other. VLANs are isolated by default, so no traffic crosses between them until you write a rule that permits it.

Three pieces do the connecting:

This is standard router-on-a-stick: a budget managed switch like the TP-Link TL-SG108E does the VLAN tagging, and your router does the routing. The rest of this guide walks through configuring each piece.

Managed vs. Unmanaged Switches

The one hard requirement for connecting VLANs is a switch that understands them, which is where the managed-versus-unmanaged distinction matters. This is the fork in the road. An unmanaged switch is what most home routers ship with built-in, or what you buy at a big-box store for $15: plug in devices, they’re all on the same network, no configuration possible. Fine for a simple home network, useless for VLANs.

A managed switch supports VLANs. You can configure which ports belong to which VLANs, whether ports are access ports (device gets one VLAN, doesn’t know about the others) or trunk ports (carries multiple VLANs, used for uplinks between switches or to a router). Management switches are slightly more expensive but not significantly so.

The budget option that actually works: TP-Link TL-SG108E

TP-Link TL-SG108E

~$25

8-port managed switch. 802.1Q VLAN tagging, port mirroring, reliable web UI. The switch this whole guide is built around.

Check Price →

The TL-SG108E is an 8-port managed switch that costs about $25. It supports 802.1Q VLANs, has a web management interface, and works reliably. It’s the most commonly recommended managed switch for homelab use because it’s cheap, available everywhere, and does exactly what you need without complexity.

For larger setups, the TP-Link TL-SG116E (16 ports, ~$67) is the same deal with more ports. Weighing it against a cheaper alternative, or wondering whether PoE or a 2.5G switch fits your setup better? The TL-SG108E vs Netgear GS308E comparison and the full buyer’s guide to budget managed switches for VLANs cover the rest of the lineup.

What about a managed switch in your router?

If you have an OpenWRT-capable router (common mid-range options include the GL.iNet MT6000 or the Asus RT-AX88U with custom firmware), you may be able to configure VLANs directly on the router without a managed switch. This works well for simpler setups where all your devices connect through the router directly.

For homelab use, a dedicated managed switch is cleaner. You run one uplink from your router to the switch (a trunk port carrying all your VLANs), and each device plugs into an access port assigned to the right VLAN.

VLAN Setup: The Basic Approach

VLAN tagging works in three steps: plan your VLAN IDs and subnets, create matching VLAN interfaces on your router, then configure your switch so the uplink port is tagged for every VLAN and each device port is untagged on just one. Firewall rules on the router then control what can cross between them.

This isn’t a step-by-step for a specific router, as configurations vary too much by vendor. But here’s the logical flow that applies regardless of what hardware you’re using:

1. Plan your VLANs before configuring anything.

Pick VLAN IDs and assign them to use cases. Common convention:

VLAN IDNamePurpose
1DefaultAvoid using this one for anything important
10TrustedDaily driver devices
20HomelabServers and services
30IoTSmart devices
40GuestInternet-only access for visitors

Write this down. You’ll reference it constantly while configuring.

2. Create the VLANs on your router.

In your router’s interface, create the VLANs as separate network interfaces, each with its own IP range. For example:

Enable DHCP on each VLAN interface so devices get addresses automatically.

3. Set firewall rules between VLANs.

This is where the security lives. By default, configure your router to:

Example exceptions that make sense:

If you’re running a reverse proxy (Nginx Proxy Manager, Caddy, or Traefik) to expose services on the Homelab VLAN, this is usually the first rule you write, since everything else routes through it instead of getting its own exception. The Nginx Proxy Manager vs Caddy vs Traefik comparison covers which one fits a setup like this best.

4. Configure trunk and access ports on the switch.

The uplink from your router to the switch should be a trunk port. It carries traffic tagged with VLAN IDs for all your VLANs simultaneously.

Each device port is an access port assigned to a single VLAN. The device plugged into that port doesn’t know about VLANs. It just gets an IP from whichever VLAN that port belongs to.

On the TP-Link TL-SG108E via the web interface:

  1. Go to 802.1Q VLAN and define your VLANs with the appropriate member ports
  2. Set the uplink port as tagged on all VLANs
  3. Set each device port as untagged on whichever VLAN it belongs to
  4. Configure the PVID (Port VLAN ID) for each access port to match its VLAN

That’s the core of it. Each vendor’s UI is different, but the concepts are the same.

For Proxmox Users: VLANs on the Server

If your homelab server is running Proxmox, you can extend VLAN logic into your VMs and containers without needing additional physical ports. Proxmox supports VLAN-aware Linux bridges.

In Proxmox, go to your node’s Network configuration and check the VLAN-aware checkbox on your main bridge (usually vmbr0). Then when creating a VM or container, you can assign it to a specific VLAN tag. The Proxmox bridge handles the tagging. The VM thinks it’s on a regular network, but the traffic hits your switch trunk with the correct VLAN tag.

This means you can run:

Your media server, Plex or Jellyfin, almost always lands on VLAN 20 with the rest of your services rather than getting its own segment; it needs to reach your NAS and doesn’t need the isolation an IoT device does. If you haven’t picked one yet, the Plex vs Jellyfin comparison breaks down which fits a segmented homelab setup like this better.

For a deeper look at how Proxmox handles bridges, VLAN tags, and its built-in firewall, the Proxmox networking guide covers all three scopes in detail.

Common Mistakes

Leaving VLAN 1 (the default) as a production VLAN. VLAN 1 is the default native VLAN on most switches and is treated differently in some configurations. Best practice is to not use it for anything important. Assign your actual traffic to higher VLAN IDs.

Forgetting to move your own devices. After configuring VLANs, you need to physically (or via your router’s wireless settings) move devices to the right VLANs. Your IoT devices don’t move themselves. You have to change which SSID they connect to, or which switch port they plug into.

Creating rules but not testing them. After setup, verify your firewall rules actually work. From a laptop on VLAN 10, try to ping a device on VLAN 30. From a device on VLAN 30, try to reach something on VLAN 20. If the blocking rules aren’t working, you’ll know immediately. It’s better to know now than to assume segmentation is working when it isn’t.

Over-engineering on day one. Four VLANs is a reasonable starting point. You don’t need fifteen. Start with Trusted, Homelab, and IoT. Add more if you have a specific reason to.

The Gear Worth Buying

For a basic segmented homelab network:

If you’re already happy with your router and it doesn’t support VLANs, that’s the bottleneck. The managed switch alone can’t create VLANs without a router that understands them. Both sides need to cooperate.

Not sure the SG108E is the right switch for your setup? The TL-SG108E vs Netgear GS308E head-to-head breaks down the cheaper alternative, and the best budget managed switch for VLANs guide covers PoE and 2.5G upgrade tiers if you need more than the basics.

VLANs feel intimidating the first time because of the terminology. Once you’ve set one up and tested it, the underlying concept is simple: devices on different VLANs can’t reach each other unless your router explicitly allows it. That’s the whole idea.

Segmenting your network handles what happens inside it. If you also want your VPN client to stop all traffic outright when the tunnel drops instead of silently falling back to your ISP connection, the VPN kill switch setup guide covers that layer.

New to homelabs entirely and not sure what to tackle after the network is sorted? The start here reading order lays out the whole path from zero to a working setup.