VLANs

A VLAN (IEEE 802.1Q) splits one physical switch network into several isolated layer-2 broadcast domains by adding a 4-byte tag with a 12-bit VLAN ID (1-4094) to Ethernet frames. In a homelab it is the standard way to separate trusted devices, servers, IoT and guests, then control traffic between them with a router/firewall. Traffic between VLANs must be routed, so that is where firewall rules apply.

Documentation: ip-link(8), VLAN type (man7.org) · Netplan reference · Proxmox network configuration

Verification: the commands and config snippets here were written from the upstream documentation and not executed. Test on a machine with console access, because a wrong network or switch config can lock you out. OPNsense and UniFi menu paths change between releases, so check the current UI.

See also: Homelab · Proxmox Networking · Proxmox Firewall · Docker Networking · UFW (uncomplicated firewall) · IPTables · dnsmasq DHCP and DNS · Reverse Proxy Patterns

Concepts #

Example plan (adapt IDs and ranges, documentation or RFC1918 space only):

Linux: iproute2 (temporary) #

Changes made with ip are lost on reboot; use netplan, NetworkManager or /etc/network/interfaces to persist.

Linux: netplan (Ubuntu) #

/etc/netplan/60-vlans.yaml:

network:
  version: 2
  ethernets:
    eno1:
      dhcp4: false
  vlans:
    vlan20:
      id: 20
      link: eno1
      addresses: [192.168.20.10/24]
      routes:
        - to: default
          via: 192.168.20.1
      nameservers:
        addresses: [192.168.20.2]
    vlan30:
      id: 30
      link: eno1
      dhcp4: true

sudo chmod 600 /etc/netplan/60-vlans.yaml
sudo netplan try        # applies, reverts after 120 s unless confirmed
sudo netplan apply

A bridge for VMs, with a tagged VLAN member:

network:
  version: 2
  ethernets:
    eno1: {}
  vlans:
    eno1.20:
      id: 20
      link: eno1
  bridges:
    br20:
      interfaces: [eno1.20]
      addresses: [192.168.20.10/24]

Linux: NetworkManager (nmcli) #

nmcli con add type vlan con-name vlan20 ifname vlan20 dev eno1 id 20 \
  ipv4.method manual ipv4.addresses 192.168.20.10/24 ipv4.gateway 192.168.20.1
nmcli con up vlan20

Proxmox: VLAN-aware bridge #

Make the bridge VLAN-aware once, then set the VLAN tag on each VM/CT NIC. The physical switch port to the node must be a trunk carrying those VLANs. See Proxmox Networking.

/etc/network/interfaces:

auto vmbr0
iface vmbr0 inet static
    address 192.168.99.10/24
    gateway 192.168.99.1
    bridge-ports eno1
    bridge-stp off
    bridge-fd 0
    bridge-vlan-aware yes
    bridge-vids 2-4094

ifreload -a             # apply (ifupdown2)

Put the host management address on a tagged sub-interface (for example vmbr0.99) when the management VLAN is not the native one.

Docker: macvlan / ipvlan on a VLAN #

Give containers addresses on a VLAN directly (see Docker Networking):

docker network create -d macvlan \
  --subnet=192.168.30.0/24 --gateway=192.168.30.1 \
  -o parent=eno1.30 vlan30

Docker host cannot reach its own macvlan containers by default; add a macvlan shim interface on the host if needed.

OPNsense #

UniFi #

• Settings -> Networks -> New Virtual Network: set name, VLAN ID, gateway/subnet, DHCP.
• Switch ports: set the Native VLAN/Network (untagged) and optionally Tagged VLAN Management (allow all / block all / custom) for trunks.
• Wi-Fi: Settings -> WiFi, choose the network each SSID maps to (IoT SSID -> IoT network).
• Isolation: use the Network/Zone and firewall settings of your UniFi OS version; “Isolate Network” or zone policies block inter-VLAN traffic, with allow rules above for exceptions.
• Management VLAN: adopt switches and APs on a dedicated VLAN; do not leave the default VLAN 1 as the only network.

Inter-VLAN Firewalling #

Default posture: each VLAN may reach the internet and the router’s DNS/DHCP, and nothing else. Add narrow allows.

Tips:

• Rules are stateful: allow Trusted -> IoT and the replies come back without an IoT -> Trusted rule.
• Force clients to use your DNS (Pi-hole, AdGuard Home) by allowing UDP/TCP 53 only to it and redirecting or blocking other port-53 traffic. DoH/DoT to public resolvers needs separate blocks (443/853).
• For host firewalls on Linux use UFW (uncomplicated firewall) or IPTables; for the hypervisor layer see Proxmox Firewall.

mDNS and Discovery Across VLANs #

mDNS (UDP 5353, multicast 224.0.0.251) and SSDP (UDP 1900) do not cross routers, so AirPlay, Chromecast, printers and Home Assistant discovery break between VLANs.

Reflection only relays discovery. The unicast connection that follows still needs a firewall allow rule (for example Trusted -> IoT).

Troubleshooting #

See Also #

• UniFi Networks and VLANs
• UniFi Firewall and VPN