The single most common mistake I see in both small business setups and enthusiast homelabs is the “flat network.” Everything—family tablets, smart lightbulbs, IP cameras, production domain controllers, client staging laptops, and storage arrays—all dumped into a single 192.168.1.0/24 subnet with zero internal boundaries.
If a cheap Wi-Fi lightbulb gets compromised, an attacker has immediate layer-2 visibility into your backup server. If a client laptop with malware connects to your Wi-Fi, it can scan your hypervisor. In my lab, I implemented a strict 10-VLAN segmentation matrix powered by a UniFi Dream Machine Pro and enterprise switches. Here is how I structured the subnets, built the firewall rules, and made smart-home devices work across VLAN boundaries.
1. The 10-VLAN Architecture
I follow a strict naming standard across UniFi: NET-<PURPOSE>-VLAN<id>. This keeps firewall rules, switch port profiles, and Wi-Fi SSIDs instantly recognizable:
| VLAN ID | Network Name | Subnet CIDR | Purpose & Security Boundary |
|---|---|---|---|
1 |
NET-MGMT-VLAN1 |
10.1.1.0/24 |
Untagged native management for switches, iDRACs, and out-of-band cards |
10 |
NET-WORKSTATIONS-VLAN10 |
10.1.10.0/24 |
Admin workstations, bench PCs, laptops, and iVentoy PXE booting |
20 |
NET-SERVERS-VLAN20 |
10.1.20.0/24 |
Production server VMs, Docker hosts (docker02), Active Directory DC |
30 |
NET-UNUSED-VLAN30 |
10.1.30.0/24 |
Quarantine subnet for unassigned switch ports (no internet, no LAN access) |
40 |
NET-IOT-VLAN40 |
10.1.40.0/24 |
Smart-home sensors, Google Cast speakers, cameras, lighting bridges |
60 |
NET-VOIP-VLAN60 |
10.1.60.0/24 |
FreePBX Asterisk PBX, SIP hardware desk phones, softphone trunks |
70 |
NET-GUEST-VLAN70 |
10.1.70.0/24 |
Visitor Wi-Fi with client isolation and rate-limited bandwidth |
98 |
NET-ISCSI-B-VLAN98 |
10.1.98.0/24 |
Dedicated EqualLogic SAN Channel B (Zero gateway routing) |
99 |
NET-ISCSI-A-VLAN99 |
10.1.99.0/24 |
Dedicated EqualLogic SAN Channel A (Zero gateway routing) |
-- |
NET-VPN-WIREGUARD |
10.1.100.0/24 |
Encrypted remote management tunnels into the core network |
2. The Firewall Rule Philosophy: Zero Trust by Default
By default, UniFi routing allows all internal VLANs to route traffic between each other. To enforce microsegmentation, you must build explicit blocking rules in LAN IN:
- Rule 2000 (Top): Allow Established & Related: If a server or workstation initiates an outbound connection to an IoT device, the return packets must be allowed back in. This rule sits at the very top of LAN IN.
- Rule 2001: Allow Admin Workstations to All LANs:
NET-WORKSTATIONS-VLAN10is allowed to initiate connections to Server VLAN 20 and IoT VLAN 40 for management purposes. - Rule 2002: Drop All IoT Traffic to Internal RFC1918: Any packet originating from
NET-IOT-VLAN40destined for any internal IP range (10.0.0.0/8,172.16.0.0/12,192.168.0.0/16) is dropped immediately. If an IoT camera is hacked, it cannot scan or communicate with a single server on our network. - Rule 2003: Drop Guest Traffic to LAN: Complete isolation for VLAN 70 visitors.
3. The IoT Cast Trap (And How to Fix It)
When you banish your Google Cast speakers, Apple TVs, and smart devices to VLAN 40, your phone on VLAN 10 suddenly stops seeing them. Why? Discovery protocols (mDNS / SSDP) rely on local link-layer multicast packets that cannot cross VLAN boundaries on their own.
The solution is not bridging the networks. On the UDM Pro, you enable Multicast DNS (mDNS) under global network settings. The UDM Pro acts as an intelligent mDNS proxy—it listens to device announcements on VLAN 40 and reflects them onto VLAN 10. You can discover and stream to your speakers seamlessly, while your firewall rules still strictly block the speakers from talking back to your servers.
4. Hardening Physical Switch Ports
Network security doesn’t end in software; it starts at the RJ45 wall jack:
- Quarantine Subnet (VLAN 30): Every unused port on our core switch (
SW-CORE-01) is set toNET-UNUSED-VLAN30. If someone plugs into an unassigned port, they get dropped into a dead-end subnet with no DHCP and no routing. - Trunk Port Profiles: Only links between switches, APs, and hypervisors carry tagged VLANs. Workstation drops are strictly untagged access ports locked to VLAN 10.
- Dedicated SAN Ports: Hypervisor and EqualLogic iSCSI ports are untagged directly into VLAN 99 and 98, keeping multi-gigabit storage traffic completely off the general switch trunk.
Segmenting a network takes careful planning upfront, but once it’s in place, you can sleep soundly knowing an infected device on your bench or a compromised smart plug is physically contained.