Segmenting networks and using VLANs are key strategies for improving security and performance.
Segmenting networks and using VLANs are key strategies for improving security and performance.
Over the past few weeks I have been slowly organizing and segmenting my network layout. I feel I have a pretty good layout but what was wondering best practices for separating devices using Vlans. Here's a list of my devices. I use PfSense and ubiquiti managed switches and access points just FYI. -trueNAS server 1 with plex, ubiquiti controller, and home assistant. -trueNAS server2 (backup in another building via ptp) - personal desktop - smart light switches - ipmi for both servers - fire TV's - echo dots - security cameras - smart phones - kids tablets - printers - smart thermostats How would you separate all of this? My main issue is the TrueNAS Scale server. I want it to be secure, but it needs to interact with all my smart home stuff for plex and home assistant.
You can stop those gadgets from connecting to the web by leaving the default gateway blank when you give them a DHCP reservation or fixed IP. Setting up home networks can be overly complicated and confusing.
Dude, vertical network segmentation isn't really about security. Most mid-sized companies I've worked with have VLANs scattered everywhere, and just managing traffic doesn't actually make the network better. Ethernet is already handling its own issues, and unless you're dealing with some specific video protocols like Crestron, filtering isn't necessary. If NetBEUI is still running, it might be time to shut down those older NT 4 SP1 devices. I'm in agreement about limiting internet access—only give devices what they truly need. Grouping devices on the firewall is a much cleaner solution than turning switches into a mess.
Combining all video cameras, phones, printers, and IoT devices onto a single 24/7 network works well.
It seems you're questioning how your setup appears secure despite certain configurations. Your approach separates different traffic types effectively—guests isolated from core systems, IoT devices confined to limited ports, and sensitive data confined to a trusted management zone. By restricting privileged access and using segmentation, you create layers of defense. Even if someone gains access, the lack of direct pathways to critical assets like your NAS or VMs adds significant protection. While it might not be foolproof against sophisticated threats, it definitely reduces risk compared to a fully open network.