[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M70G7919XTNMAJSBS32N2R4D":3,"skill-same:01M70G7919XTNMAJSBS32N2R4D":67},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":45,"commitSha":46,"skillDirectory":47,"forksCount":48,"repositoryHtmlUrl":49,"repositoryHomepageUrl":6,"ownerHtmlUrl":50,"ownerBlogUrl":6,"ownerDescription":51,"updatedAt":52,"install":53,"resources":66},"01M70G7919XTNMAJSBS32N2R4D","homelab-vlan-segmentation",null,"Segmenting home networks into VLANs for IoT, guest, trusted, and server traffic using UniFi, pfSense\u002FOPNsense, and MikroTik — including switch trunk config, firewall rules, and wireless SSID mapping. Use when splitting a home network into IoT, guest, trusted, and server VLANs on UniFi, pfSense\u002FOPNsense, or MikroTik.","mdnaimul22\u002Fhuman-skills","mdnaimul22","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F64520358?v=4","01M70FH95MH2H796Q01TYSFZ03","Naimul","01M70FH96798CQR4YHA13F17GA",3,"MIT","https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fstorage\u002Faffaan-m_ECC\u002Fhomelab-vlan-segmentation\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"homelab","homelab vlan segmentation","vlan","segmentation","iot","Rules","wireless","use","networks","for","switch","mapping","network","config","server","when","traffic","firewall","community","pfsense","2026-11-10 10:12:30",false,"---\nname: homelab-vlan-segmentation\ndescription: Segmenting home networks into VLANs for IoT, guest, trusted, and server traffic using UniFi, pfSense\u002FOPNsense, and MikroTik — including switch trunk config, firewall rules, and wireless SSID mapping. Use when splitting a home network into IoT, guest, trusted, and server VLANs on UniFi, pfSense\u002FOPNsense, or MikroTik.\nmetadata:\n  origin: community\n---\n\n# Homelab VLAN Segmentation\n\nHow to split a home network into isolated VLANs so IoT devices, guests, and your main\nPCs cannot talk to each other. The most impactful security upgrade for a home network.\n\nAll firewall rules shown here add isolation between segments — they do not remove\nexisting protections. Apply changes in a maintenance window and verify connectivity\nbetween segments after each step before moving on.\n\n## When to Use\n\n- Setting up VLANs on a home network for the first time\n- Isolating IoT devices (smart bulbs, cameras, TVs) from trusted devices\n- Creating a guest Wi-Fi network that cannot reach home devices\n- Explaining how VLANs work to someone unfamiliar with the concept\n- Configuring trunk ports, access ports, and SSID-to-VLAN mapping\n- Troubleshooting inter-VLAN routing or firewall rule issues on pfSense\u002FOPNsense\u002FUniFi\n\n## How It Works\n\n```\nWithout VLANs — flat network:\n  All devices on 192.168.1.0\u002F24\n  Smart TV (potential malware) → can reach your NAS, PCs, everything\n\nWith VLANs:\n  VLAN 10 — Trusted    192.168.10.0\u002F24  (PCs, phones, laptops)\n  VLAN 20 — IoT        192.168.20.0\u002F24  (smart TV, bulbs, cameras)\n  VLAN 30 — Servers    192.168.30.0\u002F24  (NAS, Pi, VMs)\n  VLAN 40 — Guest      192.168.40.0\u002F24  (visitor Wi-Fi)\n  VLAN 99 — Management 192.168.99.0\u002F24  (switch\u002FAP web UIs)\n\n  Smart TV → blocked from reaching 192.168.10.0\u002F24 and 192.168.30.0\u002F24\n  Guests → internet only, cannot see any home devices\n```\n\n## VLAN Design Template\n\n```\nVLAN  Name        Subnet              Gateway         Purpose\n10    trusted     192.168.10.0\u002F24     192.168.10.1    PCs, phones, laptops\n20    iot         192.168.20.0\u002F24     192.168.20.1    Smart home devices\n30    servers     192.168.30.0\u002F24     192.168.30.1    NAS, Pi, self-hosted\n40    guest       192.168.40.0\u002F24     192.168.40.1    Visitor Wi-Fi\n99    management  192.168.99.0\u002F24     192.168.99.1    Network gear web UIs\n```\n\n## Examples\n\n**Typical homelab with UniFi AP and managed switch:**\n\n```\nScenario: 3-bedroom house, UniFi Dream Machine + UniFi 8-port switch + 2 APs\n\nVLAN 10 — Trusted    192.168.10.0\u002F24   MacBook, iPhones, iPad\nVLAN 20 — IoT        192.168.20.0\u002F24   Nest thermostat, Philips Hue, Ring doorbell, smart TVs\nVLAN 30 — Servers    192.168.30.0\u002F24   Synology NAS (192.168.30.10), Pi-hole (192.168.30.2)\nVLAN 40 — Guest      192.168.40.0\u002F24   Visitor Wi-Fi — internet only\n\nSSID → VLAN mapping:\n  \"Home\"      → VLAN 10 (WPA2, strong password, trusted devices only)\n  \"IoT\"       → VLAN 20 (WPA2, separate password, printed on router for setup)\n  \"Guest\"     → VLAN 40 (WPA2, simple password you can share freely)\n\nSwitch port behavior:\n  Port 1  → trunk to router (tagged VLANs 10,20,30,40,99)\n  Port 2  → trunk to APs (tagged VLANs 10,20,40; AP handles per-SSID tagging)\n  Port 3  → access VLAN 30 (NAS — untagged, no VLAN awareness needed)\n  Port 4  → access VLAN 30 (Pi-hole — untagged)\n  Port 5–8 → access VLAN 10 (wired workstations)\n\nFirewall rules applied (all rules add isolation, none remove existing protections):\n  IoT → Trusted: BLOCK\n  IoT → Servers: BLOCK except 192.168.30.2:53 (Pi-hole DNS allowed)\n  IoT → Internet: ALLOW\n  Guest → Local networks: BLOCK\n  Guest → Internet: ALLOW\n  Trusted → everywhere: ALLOW\n```\n\n## UniFi Configuration\n\n### Create Networks in UniFi Controller\n\n```\nSettings → Networks → Create New Network\n\nFor each VLAN:\n  Name: IoT\n  Purpose: Corporate  (gives DHCP + routing)\n  VLAN ID: 20\n  Network: 192.168.20.0\u002F24\n  Gateway IP: 192.168.20.1\n  DHCP: Enable\n  DHCP Range: 192.168.20.100 – 192.168.20.254\n```\n\n### Map SSIDs to VLANs (UniFi)\n\n```\nSettings → WiFi → Create New WiFi\n\n  Name: IoT-Network\n  Password: \u003Cseparate password>\n  Network: IoT  ← select your VLAN here\n  # All devices connecting to this SSID land in VLAN 20\n\n  Name: Guest\n  Password: \u003Cguest password>\n  Network: Guest\n  Guest Policy: Enable  ← isolates guests from each other too\n```\n\n### UniFi Firewall Rules (Traffic Rules)\n\n```\nSettings → Traffic & Security → Traffic Rules\n\n# Block IoT from reaching Trusted VLAN\n  Action: Block\n  Category: Local Network\n  Source: IoT (192.168.20.0\u002F24)\n  Destination: Trusted (192.168.10.0\u002F24)\n\n# Allow IoT to reach internet only\n  Action: Allow\n  Source: IoT\n  Destination: Internet\n\n# Block Guest from all local networks\n  Action: Block\n  Source: Guest\n  Destination: Local Networks\n```\n\n## pfSense \u002F OPNsense Configuration\n\n### Create VLANs\n\n```\nInterfaces → Assignments → VLANs → Add\n\n  Parent Interface: em1  (your LAN NIC)\n  VLAN Tag: 20\n  Description: IoT\n\n# Repeat for each VLAN, then assign each VLAN to an interface:\nInterfaces → Assignments → Add\n  Select the VLAN you created → click Add\n  Enable the interface, set IP to gateway address (192.168.20.1\u002F24)\n```\n\n### DHCP for Each VLAN\n\n```\nServices → DHCP Server → Select your VLAN interface\n\n  Enable DHCP\n  Range: 192.168.20.100 to 192.168.20.254\n  DNS Servers: 192.168.30.2  ← Pi-hole IP if you have one\n```\n\n### Firewall Rules (pfSense\u002FOPNsense)\n\n```\n# Rules are processed top-to-bottom, first match wins.\n\n# On the IoT interface (VLAN 20):\n  Rule 1: Allow IoT → Pi-hole DNS  ← MUST come before the RFC1918 block rule\n    Protocol: UDP\u002FTCP\n    Source: IoT net\n    Destination: 192.168.30.2 port 53\n    Action: Allow\n\n  Rule 2: Block IoT → RFC1918 (all private IP ranges)\n    Protocol: any\n    Source: IoT net\n    Destination: RFC1918  (192.168.0.0\u002F16, 10.0.0.0\u002F8, 172.16.0.0\u002F12)\n    Action: Block\n\n  Rule 3: Allow IoT → internet\n    Protocol: any\n    Source: IoT net\n    Destination: any\n    Action: Allow\n\n# On the Trusted interface (VLAN 10):\n  Allow all (trusted devices can reach everything)\n    Source: Trusted net\n    Destination: any\n    Action: Allow\n\n# Additional exceptions for IoT devices that need specific local services:\n  Insert before Rule 2 (the RFC1918 block):\n    Protocol: TCP\n    Source: IoT net\n    Destination: 192.168.30.x port 8123  ← Home Assistant\n    Action: Allow\n```\n\n## MikroTik Configuration\n\n```\n# Step 1: Create a bridge with VLAN filtering enabled\n\u002Finterface bridge\nadd name=bridge vlan-filtering=yes\n\n# Step 2: Add physical ports to the bridge\n# Trunk port to router\u002Fuplink (tagged for all VLANs)\n\u002Finterface bridge port\nadd bridge=bridge interface=ether1 frame-types=admit-only-vlan-tagged\n\n# Access port for trusted devices (untagged VLAN 10)\n\u002Finterface bridge port\nadd bridge=bridge interface=ether2 pvid=10 frame-types=admit-only-untagged-and-priority-tagged\n\n# Access port for IoT devices (untagged VLAN 20)\n\u002Finterface bridge port\nadd bridge=bridge interface=ether3 pvid=20 frame-types=admit-only-untagged-and-priority-tagged\n\n# Step 3: Define which VLANs are allowed on which ports\n\u002Finterface bridge vlan\nadd bridge=bridge tagged=ether1 untagged=ether2 vlan-ids=10\nadd bridge=bridge tagged=ether1 untagged=ether3 vlan-ids=20\n\n# Step 4: Create VLAN interfaces on the bridge (gateway IPs)\n\u002Finterface vlan\nadd interface=bridge name=vlan10 vlan-id=10\nadd interface=bridge name=vlan20 vlan-id=20\n\n# Step 5: Assign gateway IPs\n\u002Fip address\nadd interface=vlan10 address=192.168.10.1\u002F24\nadd interface=vlan20 address=192.168.20.1\u002F24\n\n# Step 6: DHCP pools and servers\n\u002Fip pool\nadd name=pool-trusted ranges=192.168.10.100-192.168.10.254\nadd name=pool-iot ranges=192.168.20.100-192.168.20.254\n\n\u002Fip dhcp-server\nadd interface=vlan10 address-pool=pool-trusted name=dhcp-trusted\nadd interface=vlan20 address-pool=pool-iot name=dhcp-iot\n\n\u002Fip dhcp-server network\nadd address=192.168.10.0\u002F24 gateway=192.168.10.1\nadd address=192.168.20.0\u002F24 gateway=192.168.20.1\n\n# Step 7: Firewall — block IoT from reaching trusted VLAN\n\u002Fip firewall filter\nadd chain=forward src-address=192.168.20.0\u002F24 dst-address=192.168.10.0\u002F24 \\\n    action=drop comment=\"Block IoT to Trusted\"\n```\n\n## Switch Trunk vs Access Ports\n\n```\n# Trunk port: carries multiple VLANs (tagged) — connects switch-to-switch, switch-to-router, switch-to-AP\n# Access port: carries one VLAN (untagged) — connects to end devices (PC, camera, NAS)\n\n# A managed switch port connected to your router should be a trunk:\n  Allowed VLANs: 10, 20, 30, 40, 99\n\n# A port connecting to a PC should be an access port:\n  VLAN: 10 (trusted)\n  No tagging — the PC does not know or care about VLANs\n\n# A port connecting to an AP must be a trunk:\n  The AP tags traffic from each SSID with the right VLAN ID\n  Allowed VLANs: 10, 20, 40  (whichever SSIDs the AP serves)\n```\n\n## Anti-Patterns\n\n```\n# BAD: Creating VLANs without adding firewall rules\n# VLANs without firewall rules do not provide security — inter-VLAN routing is open by default\n# GOOD: Add explicit block rules immediately after creating VLANs\n\n# BAD: Putting the Pi-hole in the IoT VLAN\n# IoT devices can reach it but trusted devices cannot (without extra rules)\n# GOOD: Pi-hole in the Servers VLAN with a rule allowing all VLANs to reach port 53\n\n# BAD: Native VLAN equals management VLAN\n# Untagged traffic landing in your management VLAN enables VLAN hopping attacks\n# GOOD: Use a dedicated unused VLAN as native (e.g. VLAN 999), keep management traffic tagged\n\n# BAD: Same Wi-Fi password for IoT SSID and trusted SSID\n# Anyone who learns the password can connect IoT devices to the wrong segment\n```\n\n## Best Practices\n\n- Start with 4 VLANs: Trusted, IoT, Servers, Guest — add more as needed\n- Put Pi-hole in the Servers VLAN (192.168.30.x)\n- Add a firewall rule allowing DNS (port 53) from all VLANs to the Pi-hole IP — before any RFC1918 block rule\n- Test isolation after every rule change: from the IoT VLAN, try to ping a trusted device — it should fail\n- Use a management VLAN for switch and AP web UIs and restrict access to the Trusted VLAN only\n- Document your VLAN design in a table (VLAN ID, name, subnet, purpose)\n\n## Related Skills\n\n- homelab-network-setup\n- homelab-pihole-dns\n- homelab-wireguard-vpn\n","# Homelab VLAN Segmentation\n\nHow to split a home network into isolated VLANs so IoT devices, guests, and your main\nPCs cannot talk to each other. The most impactful security upgrade for a home network.\n\nAll firewall rules shown here add isolation between segments — they do not remove\nexisting protections. Apply changes in a maintenance window and verify connectivity\nbetween segments after each step before moving on.\n\n## When to Use\n\n- Setting up VLANs on a home network for the first time\n- Isolating IoT devices (smart bulbs, cameras, TVs) from trusted devices\n- Creating a guest Wi-Fi network that cannot reach home devices\n- Explaining how VLANs work to someone unfamiliar with the concept\n- Configuring trunk ports, access ports, and SSID-to-VLAN mapping\n- Troubleshooting inter-VLAN routing or firewall rule issues on pfSense\u002FOPNsense\u002FUniFi\n\n## How It Works\n\n```\nWithout VLANs — flat network:\n  All devices on 192.168.1.0\u002F24\n  Smart TV (potential malware) → can reach your NAS, PCs, everything\n\nWith VLANs:\n  VLAN 10 — Trusted    192.168.10.0\u002F24  (PCs, phones, laptops)\n  VLAN 20 — IoT        192.168.20.0\u002F24  (smart TV, bulbs, cameras)\n  VLAN 30 — Servers    192.168.30.0\u002F24  (NAS, Pi, VMs)\n  VLAN 40 — Guest      192.168.40.0\u002F24  (visitor Wi-Fi)\n  VLAN 99 — Management 192.168.99.0\u002F24  (switch\u002FAP web UIs)\n\n  Smart TV → blocked from reaching 192.168.10.0\u002F24 and 192.168.30.0\u002F24\n  Guests → internet only, cannot see any home devices\n```\n\n## VLAN Design Template\n\n```\nVLAN  Name        Subnet              Gateway         Purpose\n10    trusted     192.168.10.0\u002F24     192.168.10.1    PCs, phones, laptops\n20    iot         192.168.20.0\u002F24     192.168.20.1    Smart home devices\n30    servers     192.168.30.0\u002F24     192.168.30.1    NAS, Pi, self-hosted\n40    guest       192.168.40.0\u002F24     192.168.40.1    Visitor Wi-Fi\n99    management  192.168.99.0\u002F24     192.168.99.1    Network gear web UIs\n```\n\n## Examples\n\n**Typical homelab with UniFi AP and managed switch:**\n\n```\nScenario: 3-bedroom house, UniFi Dream Machine + UniFi 8-port switch + 2 APs\n\nVLAN 10 — Trusted    192.168.10.0\u002F24   MacBook, iPhones, iPad\nVLAN 20 — IoT        192.168.20.0\u002F24   Nest thermostat, Philips Hue, Ring doorbell, smart TVs\nVLAN 30 — Servers    192.168.30.0\u002F24   Synology NAS (192.168.30.10), Pi-hole (192.168.30.2)\nVLAN 40 — Guest      192.168.40.0\u002F24   Visitor Wi-Fi — internet only\n\nSSID → VLAN mapping:\n  \"Home\"      → VLAN 10 (WPA2, strong password, trusted devices only)\n  \"IoT\"       → VLAN 20 (WPA2, separate password, printed on router for setup)\n  \"Guest\"     → VLAN 40 (WPA2, simple password you can share freely)\n\nSwitch port behavior:\n  Port 1  → trunk to router (tagged VLANs 10,20,30,40,99)\n  Port 2  → trunk to APs (tagged VLANs 10,20,40; AP handles per-SSID tagging)\n  Port 3  → access VLAN 30 (NAS — untagged, no VLAN awareness needed)\n  Port 4  → access VLAN 30 (Pi-hole — untagged)\n  Port 5–8 → access VLAN 10 (wired workstations)\n\nFirewall rules applied (all rules add isolation, none remove existing protections):\n  IoT → Trusted: BLOCK\n  IoT → Servers: BLOCK except 192.168.30.2:53 (Pi-hole DNS allowed)\n  IoT → Internet: ALLOW\n  Guest → Local networks: BLOCK\n  Guest → Internet: ALLOW\n  Trusted → everywhere: ALLOW\n```\n\n## UniFi Configuration\n\n### Create Networks in UniFi Controller\n\n```\nSettings → Networks → Create New Network\n\nFor each VLAN:\n  Name: IoT\n  Purpose: Corporate  (gives DHCP + routing)\n  VLAN ID: 20\n  Network: 192.168.20.0\u002F24\n  Gateway IP: 192.168.20.1\n  DHCP: Enable\n  DHCP Range: 192.168.20.100 – 192.168.20.254\n```\n\n### Map SSIDs to VLANs (UniFi)\n\n```\nSettings → WiFi → Create New WiFi\n\n  Name: IoT-Network\n  Password: \u003Cseparate password>\n  Network: IoT  ← select your VLAN here\n  # All devices connecting to this SSID land in VLAN 20\n\n  Name: Guest\n  Password: \u003Cguest password>\n  Network: Guest\n  Guest Policy: Enable  ← isolates guests from each other too\n```\n\n### UniFi Firewall Rules (Traffic Rules)\n\n```\nSettings → Traffic & Security → Traffic Rules\n\n# Block IoT from reaching Trusted VLAN\n  Action: Block\n  Category: Local Network\n  Source: IoT (192.168.20.0\u002F24)\n  Destination: Trusted (192.168.10.0\u002F24)\n\n# Allow IoT to reach internet only\n  Action: Allow\n  Source: IoT\n  Destination: Internet\n\n# Block Guest from all local networks\n  Action: Block\n  Source: Guest\n  Destination: Local Networks\n```\n\n## pfSense \u002F OPNsense Configuration\n\n### Create VLANs\n\n```\nInterfaces → Assignments → VLANs → Add\n\n  Parent Interface: em1  (your LAN NIC)\n  VLAN Tag: 20\n  Description: IoT\n\n# Repeat for each VLAN, then assign each VLAN to an interface:\nInterfaces → Assignments → Add\n  Select the VLAN you created → click Add\n  Enable the interface, set IP to gateway address (192.168.20.1\u002F24)\n```\n\n### DHCP for Each VLAN\n\n```\nServices → DHCP Server → Select your VLAN interface\n\n  Enable DHCP\n  Range: 192.168.20.100 to 192.168.20.254\n  DNS Servers: 192.168.30.2  ← Pi-hole IP if you have one\n```\n\n### Firewall Rules (pfSense\u002FOPNsense)\n\n```\n# Rules are processed top-to-bottom, first match wins.\n\n# On the IoT interface (VLAN 20):\n  Rule 1: Allow IoT → Pi-hole DNS  ← MUST come before the RFC1918 block rule\n    Protocol: UDP\u002FTCP\n    Source: IoT net\n    Destination: 192.168.30.2 port 53\n    Action: Allow\n\n  Rule 2: Block IoT → RFC1918 (all private IP ranges)\n    Protocol: any\n    Source: IoT net\n    Destination: RFC1918  (192.168.0.0\u002F16, 10.0.0.0\u002F8, 172.16.0.0\u002F12)\n    Action: Block\n\n  Rule 3: Allow IoT → internet\n    Protocol: any\n    Source: IoT net\n    Destination: any\n    Action: Allow\n\n# On the Trusted interface (VLAN 10):\n  Allow all (trusted devices can reach everything)\n    Source: Trusted net\n    Destination: any\n    Action: Allow\n\n# Additional exceptions for IoT devices that need specific local services:\n  Insert before Rule 2 (the RFC1918 block):\n    Protocol: TCP\n    Source: IoT net\n    Destination: 192.168.30.x port 8123  ← Home Assistant\n    Action: Allow\n```\n\n## MikroTik Configuration\n\n```\n# Step 1: Create a bridge with VLAN filtering enabled\n\u002Finterface bridge\nadd name=bridge vlan-filtering=yes\n\n# Step 2: Add physical ports to the bridge\n# Trunk port to router\u002Fuplink (tagged for all VLANs)\n\u002Finterface bridge port\nadd bridge=bridge interface=ether1 frame-types=admit-only-vlan-tagged\n\n# Access port for trusted devices (untagged VLAN 10)\n\u002Finterface bridge port\nadd bridge=bridge interface=ether2 pvid=10 frame-types=admit-only-untagged-and-priority-tagged\n\n# Access port for IoT devices (untagged VLAN 20)\n\u002Finterface bridge port\nadd bridge=bridge interface=ether3 pvid=20 frame-types=admit-only-untagged-and-priority-tagged\n\n# Step 3: Define which VLANs are allowed on which ports\n\u002Finterface bridge vlan\nadd bridge=bridge tagged=ether1 untagged=ether2 vlan-ids=10\nadd bridge=bridge tagged=ether1 untagged=ether3 vlan-ids=20\n\n# Step 4: Create VLAN interfaces on the bridge (gateway IPs)\n\u002Finterface vlan\nadd interface=bridge name=vlan10 vlan-id=10\nadd interface=bridge name=vlan20 vlan-id=20\n\n# Step 5: Assign gateway IPs\n\u002Fip address\nadd interface=vlan10 address=192.168.10.1\u002F24\nadd interface=vlan20 address=192.168.20.1\u002F24\n\n# Step 6: DHCP pools and servers\n\u002Fip pool\nadd name=pool-trusted ranges=192.168.10.100-192.168.10.254\nadd name=pool-iot ranges=192.168.20.100-192.168.20.254\n\n\u002Fip dhcp-server\nadd interface=vlan10 address-pool=pool-trusted name=dhcp-trusted\nadd interface=vlan20 address-pool=pool-iot name=dhcp-iot\n\n\u002Fip dhcp-server network\nadd address=192.168.10.0\u002F24 gateway=192.168.10.1\nadd address=192.168.20.0\u002F24 gateway=192.168.20.1\n\n# Step 7: Firewall — block IoT from reaching trusted VLAN\n\u002Fip firewall filter\nadd chain=forward src-address=192.168.20.0\u002F24 dst-address=192.168.10.0\u002F24 \\\n    action=drop comment=\"Block IoT to Trusted\"\n```\n\n## Switch Trunk vs Access Ports\n\n```\n# Trunk port: carries multiple VLANs (tagged) — connects switch-to-switch, switch-to-router, switch-to-AP\n# Access port: carries one VLAN (untagged) — connects to end devices (PC, camera, NAS)\n\n# A managed switch port connected to your router should be a trunk:\n  Allowed VLANs: 10, 20, 30, 40, 99\n\n# A port connecting to a PC should be an access port:\n  VLAN: 10 (trusted)\n  No tagging — the PC does not know or care about VLANs\n\n# A port connecting to an AP must be a trunk:\n  The AP tags traffic from each SSID with the right VLAN ID\n  Allowed VLANs: 10, 20, 40  (whichever SSIDs the AP serves)\n```\n\n## Anti-Patterns\n\n```\n# BAD: Creating VLANs without adding firewall rules\n# VLANs without firewall rules do not provide security — inter-VLAN routing is open by default\n# GOOD: Add explicit block rules immediately after creating VLANs\n\n# BAD: Putting the Pi-hole in the IoT VLAN\n# IoT devices can reach it but trusted devices cannot (without extra rules)\n# GOOD: Pi-hole in the Servers VLAN with a rule allowing all VLANs to reach port 53\n\n# BAD: Native VLAN equals management VLAN\n# Untagged traffic landing in your management VLAN enables VLAN hopping attacks\n# GOOD: Use a dedicated unused VLAN as native (e.g. VLAN 999), keep management traffic tagged\n\n# BAD: Same Wi-Fi password for IoT SSID and trusted SSID\n# Anyone who learns the password can connect IoT devices to the wrong segment\n```\n\n## Best Practices\n\n- Start with 4 VLANs: Trusted, IoT, Servers, Guest — add more as needed\n- Put Pi-hole in the Servers VLAN (192.168.30.x)\n- Add a firewall rule allowing DNS (port 53) from all VLANs to the Pi-hole IP — before any RFC1918 block rule\n- Test isolation after every rule change: from the IoT VLAN, try to ping a trusted device — it should fail\n- Use a management VLAN for switch and AP web UIs and restrict access to the Trusted VLAN only\n- Document your VLAN design in a table (VLAN ID, name, subnet, purpose)\n\n## Related Skills\n\n- homelab-network-setup\n- homelab-pihole-dns\n- homelab-wireguard-vpn\n",{"name":5,"metadata":44,"description":7},{"origin":37},"main","74715deacdc69119d739f38916f8ee4f0f979ebf","skills\u002Fstorage\u002Faffaan-m_ECC\u002Fhomelab-vlan-segmentation",0,"https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills","https:\u002F\u002Fgithub.com\u002Fmdnaimul22","AI Agents Workflows Automation | Specializing in Python, FastAPI, MCP Agents & Custom ERP.","2026-11-11 06:54:12",{"source":8,"skillName":5,"commands":54,"prompt":64,"zipAvailable":65},[55,58,61],{"tool":56,"command":57},"npx","npx skills add mdnaimul22\u002Fhuman-skills --skill homelab-vlan-segmentation",{"tool":59,"command":60},"bunx","bunx skills add mdnaimul22\u002Fhuman-skills --skill homelab-vlan-segmentation",{"tool":62,"command":63},"pnpm","pnpm dlx skills add mdnaimul22\u002Fhuman-skills --skill homelab-vlan-segmentation","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fstorage\u002Faffaan-m_ECC\u002Fhomelab-vlan-segmentation\u002FSKILL.md",true,[],[68,76,106,127,146,161],{"skillNo":69,"name":70,"nameZh":6,"description":71,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":72,"categories":73,"keywords":74,"publishedAt":75},"01M72JT3YP1SQHD0MANGDXQ4RT","higgsfield-websites","Build, edit, and deploy full-stack websites, apps and games via the Higgsfield CLI (`higgsfield website …`). Each is a React 19 + TanStack Start SSR app in one Cloudflare Worker (D1\u002FR2\u002FKV\u002FDO\u002FContainers). THREE product types, picked via `--type` on create: `website` (standalone, no Higgsfield integration — references\u002Fwebsite-flow.md), `app` (Sign in with Higgsfield + fnf SDK, Quanta — references\u002Fapp-flow.md), `game` (realtime multiplayer rooms — references\u002Fgame-flow.md). Routes to the right flow; each carries its own rules and deploy\u002Fpublish gates.\nUse when: \"build me a website\", \"make a landing page\", \"create a web app\", \"build a SaaS dashboard \u002F portfolio\", \"make me a game\", \"deploy this site\", \"publish\". Also owns GAME ART: \"make a spritesheet\", \"tileable texture\", \"animate a 3D character\", game music\u002FSFX — see the game-* references.\nNOT for: single image\u002Fvideo\u002Faudio generation (higgsfield-generate), product photos (higgsfield-product-photoshoot), marketplace cards (higgsfield-marketplace-cards).","https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fstorage\u002Fhiggsfield-ai_skills\u002Fhiggsfield-websites\u002FSKILL.md",[],[],"2026-11-10 22:39:42",{"skillNo":77,"name":78,"nameZh":6,"description":79,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":80,"categories":81,"keywords":98,"publishedAt":39},"01M70JPK8HAXXA85P7Q8NKZZYG","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fstorage\u002Fobra_superpowers\u002Fwriting-skills\u002FSKILL.md",[82,87,92,95],{"categoryNo":83,"categoryName":84,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000018","写作与文案","SCENARIO","使用场景",{"categoryNo":88,"categoryName":89,"taxonomyType":90,"taxonomyTypeDesc":91},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",{"categoryNo":93,"categoryName":94,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":96,"categoryName":97,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000008","测试与质量",[99,100,101,102,26,103,104,34,105],"writing","writing skills","editing","deployment","Existing","new","work",{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":117,"publishedAt":39},"01M70JP4PHBH1CQVVDWZ94W159","writing-plans","Use when you have a spec or requirements for a multi-step task, before touching code","https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fstorage\u002Fobra_superpowers\u002Fwriting-plans\u002FSKILL.md",[112,113,114],{"categoryNo":83,"categoryName":84,"taxonomyType":85,"taxonomyTypeDesc":86},{"categoryNo":88,"categoryName":89,"taxonomyType":90,"taxonomyTypeDesc":91},{"categoryNo":115,"categoryName":116,"taxonomyType":90,"taxonomyTypeDesc":91},"01JBSEEDCAT000000000000030","开发工程师",[99,118,119,120,34,121,28,26,122,123,124,125,126],"writing plans","plans","you","code","requirements","task","multi","spec","multi-step task",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":133,"publishedAt":39},"01M70JNTYVGXFZT8PASZ844TH8","verification-before-completion","Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions always","https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fstorage\u002Fobra_superpowers\u002Fverification-before-completion\u002FSKILL.md",[],[134,135,136,137,138,139,26,140,141,142,34,143,105,144,145],"verification","verification before completion","complete","about","output","assertions","prs","evidence","claim","claims","commands","running",{"skillNo":147,"name":148,"nameZh":6,"description":149,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":153,"publishedAt":39},"01M70JNGVSQDESWN0Q5BPJ875V","using-superpowers","Use when starting any conversation - establishes how to find and use skills, requiring skill invocation before ANY response including clarifying questions","https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fstorage\u002Fobra_superpowers\u002Fusing-superpowers\u002FSKILL.md",[152],{"categoryNo":93,"categoryName":94,"taxonomyType":85,"taxonomyTypeDesc":86},[154,155,156,157,26,34,158,159,160],"using superpowers","superpowers","conversation","how to","how","find","questions",{"skillNo":162,"name":163,"nameZh":6,"description":164,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":167,"publishedAt":39},"01M70JN57CE588NPYPYTWH1DWG","using-git-worktrees","Use when starting feature work that needs isolation from current workspace or before executing implementation plans - ensures an isolated workspace exists via native tools or git worktree fallback","https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fstorage\u002Fobra_superpowers\u002Fusing-git-worktrees\u002FSKILL.md",[],[168,169,170,171,172,173,34,105,174,175,176,177,178,179,180,119,26,181,182],"using git worktrees","Using git","git","worktrees","git worktrees","implementation","git worktree","worktree","native","Tools","isolation","fallback","feature","via","workspace"]