Who This Is For
Intermediate to advanced.
Think of it like separate playdates for kids and adults at a party. Your smart fridge and your work laptop probably shouldn't be free to wander into each other's rooms.
What You'll Build
IoT devices with internet access but no ability to freely reach workstations, management interfaces, or server admin pages.
Prerequisites
- A VLAN-capable router/firewall
- A managed switch
- A VLAN-aware access point
Architecture
Reference design:
VLAN Fundamentals
- Access port, carries one untagged VLAN, used for end devices
- Trunk port, carries multiple tagged VLANs, used between switches/router/AP
- Inter-VLAN routing, the firewall rules that decide what can talk to what across VLANs
Reference VLAN Layout
$VLAN 20, Trusted LAN
$VLAN 30, Servers
$VLAN 40, IoT
$VLAN 50, Guest Wi-Fi
Create the VLANs
Define each VLAN interface on your router/firewall, then set matching DHCP scopes per VLAN.
Firewall Policy Examples
- IoT → internet: allowed
- IoT → trusted LAN: blocked
- Trusted LAN → IoT: limited and intentional (e.g. controlling a smart plug)
- IoT → Home Assistant: allow only the specific required ports
- Guest Wi-Fi → all internal VLANs: blocked
Handle mDNS and Casting
Chromecast, AirPlay, and many smart-home discovery protocols rely on mDNS, which doesn't cross VLANs by default. You'll need an mDNS reflector or specific exceptions for casting/printing to keep working across VLANs.
Validate the Setup
$nslookup
Confirm from an IoT-VLAN device that it can reach the internet but not your workstation, and check firewall logs to see the blocks actually happening.
Security & Backup Notes
- Rule order matters, a broad "allow" rule placed above a specific "deny" rule will silently permit traffic you meant to block
Troubleshooting
- Wi-Fi SSID maps to the wrong VLAN, double-check the AP's SSID-to-VLAN tag mapping
- DHCP fails, confirm the DHCP relay/scope is correctly bound to the new VLAN interface
- Tagged VLAN not accepted by access point, the AP's uplink port needs to be a trunk, not an access port
- Smart TV casting stops working, classic mDNS-across-VLANs issue; add an mDNS reflector
- Rule order accidentally permits traffic, firewall rules are evaluated top-down; reorder so specific denies come before broad allows
Lab Finish Line
IoT devices have internet access but cannot freely access workstations, management interfaces, or server admin pages.