Segmentation Without a Rack: VLANs for a Victorian Terrace Home Network
Photo: small managed network switch in Victorian terrace home cupboard, via img.freepik.com
The terrace constraint is physical, not logical
A Victorian terrace imposes a particular kind of network design. The hallway is narrow, the stair cupboard is full, the walls are solid, and there is no obvious place for a rack. None of that prevents VLAN segmentation. It simply means the segmentation has to live in a small managed switch, a firewall with several logical interfaces and a handful of access points, rather than in a cabinet with patch panels and labelled trunks.
The goal is not to build an enterprise network in a house. It is to stop the smart doorbell, the guest phone and the work laptop from sharing one broadcast domain, while keeping printers and speakers usable. That requires a clear VLAN plan, a router that can enforce policy between those VLANs, and a switch that can carry the tags.
Put the ISP equipment in its place
The first decision is whether the ISP router can be reduced to a modem. Some UK ISP routers support bridge or modem mode; others do not, or support it only on certain products. Where bridge mode is available, use it and let the firewall handle PPPoE, DHCP and firewall policy. Where it is not, the practical options are to replace the ISP router with a compatible third-party firewall and authenticate directly, or to accept a double-NAT arrangement for the household while keeping the lab behind the firewall. The second option is workable for browsing but poor for inbound services and some VPNs.
For Openreach FTTP, check whether the ISP uses a VLAN for PPPoE; some do, some do not. Getting that detail wrong is a common cause of a firewall that appears to have a WAN link but never receives an address. Keep the ISP router's credentials and any line configuration documented before changing the topology.
A small VLAN plan that survives family life
A plan with five VLANs is usually enough for a terrace: management, work, IoT, guest and NAS. Management carries switch and access point addresses. Work carries laptops and phones used for business. IoT carries smart plugs, cameras, heating controls and media devices. Guest is internet-only. NAS is a small storage and backup segment, reachable only from work and management.
| VLAN | Purpose | Typical access |
|---|---|---|
| 10 | Management | Wired admin ports, access point management |
| 20 | Work | Work laptops, business phones |
| 30 | IoT | Smart plugs, cameras, speakers, printers |
| 40 | Guest | Visitor phones and laptops |
| 50 | NAS | Storage, backup target |
Use 802.1Q trunks between the firewall and the managed switch, and access ports for devices. Map one SSID to each wireless VLAN rather than relying on client isolation alone. Keep the management VLAN off the wireless unless there is a specific need.
Switching without a rack
A fanless eight-port managed switch in the stair cupboard is often the whole distribution layer. It needs 802.1Q VLAN support, IGMP snooping and, ideally, PoE for an access point. Avoid powerline adaptors as VLAN carriers; they are unpredictable and rarely honour tags. If Wi-Fi coverage is the problem, add a wired access point on each floor rather than a mesh system that cannot map SSIDs to VLANs.
Label the ports before switching from untagged to tagged operation. A mistaken trunk can take the household offline in a way that is hard to diagnose without console access. Keep a known-good untagged management port and a rollback cable nearby.
Firewall rules that do not annoy
Default deny between VLANs is the correct starting point, but it needs sensible exceptions. Work should reach the NAS on the specific file-sharing or backup ports in use. Guest should reach the internet only. IoT should reach the internet and, where required, the mDNS reflector. Management should be reachable only from a trusted admin port.
Stateful rules handle return traffic; do not open broad ranges in both directions. Log denied traffic for a week and review it. Most household breakage comes from a missing DNS rule, a blocked NTP server or a printer that cannot be discovered, not from a sophisticated attack.
mDNS reflection for printers and speakers
AirPrint printers, Chromecast devices and Sonos speakers rely on multicast DNS. Once they sit on an IoT VLAN and the laptop sits on work, discovery stops unless the firewall reflects mDNS between the relevant segments. On OPNsense or pfSense this is usually the Avahi reflector; on other platforms it may be an mDNS repeater package. Allow UDP 5353 between the VLANs that need discovery, and ensure IGMP snooping and a querier are active on the switch.
Reflect only where necessary. A guest VLAN rarely needs to see the printer. Keeping reflection narrow reduces noise and makes faults easier to trace.
Test segmentation without breaking the household
Move one device at a time. Start with a printer or a speaker, confirm discovery, then move the next. Use ping and a port scan from each VLAN to verify that expected paths work and unexpected paths fail. Keep the old wireless SSID available for a week and document the rollback. A maintenance window is preferable, but a terrace household rarely grants one; short, reversible changes are safer than a full cutover on a Sunday evening.
Segmentation is not about making the network complicated. It is about making failure and trust boundaries visible. In a small UK home, that can be achieved with a fanless switch, a firewall with five interfaces and a little patience.
