Dec 05, 2024 · Networking / Advanced · ~3 MIN READ

Create a Separate VLAN for IoT Devices

Isolate smart devices without breaking normal household use — VLAN fundamentals, firewall policy, and mDNS/casting fixes.

Who This Is For

Intermediate to advanced.

Think of it like separate playdates for kids and adults at a party. Your smart fridge and your work laptop probably shouldn’t be free to wander into each other’s rooms.

What You’ll Build

IoT devices with internet access but no ability to freely reach workstations, management interfaces, or server admin pages.

Prerequisites

A VLAN-capable router/firewall
A managed switch
A VLAN-aware access point

Architecture

Reference design:

VLAN Fundamentals

Access port, carries one untagged VLAN, used for end devices
Trunk port, carries multiple tagged VLANs, used between switches/router/AP
Inter-VLAN routing, the firewall rules that decide what can talk to what across VLANs

Reference VLAN Layout

$ VLAN 10, Management
$ VLAN 20, Trusted LAN
$ VLAN 30, Servers
$ VLAN 40, IoT
$ VLAN 50, Guest Wi-Fi

Create the VLANs

Define each VLAN interface on your router/firewall, then set matching DHCP scopes per VLAN.

Firewall Policy Examples

IoT → internet: allowed
IoT → trusted LAN: blocked
Trusted LAN → IoT: limited and intentional (e.g. controlling a smart plug)
IoT → Home Assistant: allow only the specific required ports
Guest Wi-Fi → all internal VLANs: blocked

Handle mDNS and Casting

Chromecast, AirPlay, and many smart-home discovery protocols rely on mDNS, which doesn’t cross VLANs by default. You’ll need an mDNS reflector or specific exceptions for casting/printing to keep working across VLANs.

Validate the Setup

$ ping
$ nslookup

Confirm from an IoT-VLAN device that it can reach the internet but not your workstation, and check firewall logs to see the blocks actually happening.

Security & Backup Notes

Rule order matters, a broad “allow” rule placed above a specific “deny” rule will silently permit traffic you meant to block

Troubleshooting

Wi-Fi SSID maps to the wrong VLAN, double-check the AP’s SSID-to-VLAN tag mapping
DHCP fails, confirm the DHCP relay/scope is correctly bound to the new VLAN interface
Tagged VLAN not accepted by access point, the AP’s uplink port needs to be a trunk, not an access port
Smart TV casting stops working, classic mDNS-across-VLANs issue; add an mDNS reflector
Rule order accidentally permits traffic, firewall rules are evaluated top-down; reorder so specific denies come before broad allows

Lab Finish Line

IoT devices have internet access but cannot freely access workstations, management interfaces, or server admin pages.