Homelab Networking Basics: VLANs, Subnets, and Managed Switches

Most homelab guides jump straight to servers and skip networking, which is backwards — your network is what actually connects everything you build. A little bit of structure here saves a lot of headaches later, especially once you're running more than two or three devices.

VLANs, in plain terms

A VLAN (Virtual LAN) lets you split one physical network into several logically separate ones, without running separate cables. In practice, this means your smart home devices, your homelab servers, your personal laptop, and any guest devices can all share the same switch and router while staying isolated from each other. If a cheap IoT camera gets compromised, it can't casually see the rest of your network.

This isn't just an enterprise concept borrowed for fun — it's genuinely one of the highest value-per-hour changes you can make to a home network, and most consumer routers running third-party firmware (or a UniFi/pfSense setup) support it out of the box.

Subnets, without the math anxiety

A subnet is just a defined range of IP addresses. When you create a VLAN, you typically give it its own subnet — for example, your main network might be 192.168.1.0/24, while your IoT VLAN gets 192.168.20.0/24. Devices on different subnets can't talk to each other unless your router or firewall explicitly allows it. That's the mechanism that actually enforces the isolation VLANs set up.

When a managed switch is worth it

An unmanaged switch just passes traffic through — no VLANs, no port control, no visibility. A managed switch lets you assign VLANs per port, monitor traffic, and configure link aggregation. If you're running one or two devices, you don't need one. The moment you're segmenting IoT from your main network, or running more than a handful of wired devices, it becomes worth the upgrade. Entry-level managed switches (Ubiquiti's UniFi line, or used Cisco Catalyst gear) start well under $150.

A reasonable starting setup

• One VLAN for trusted personal devices
• One VLAN for IoT / smart home devices
• One VLAN for your homelab servers
• Firewall rules that default to blocking cross-VLAN traffic, with specific exceptions added as needed

Next steps

Once your network is segmented, it's worth extending the same thinking into a full home network security project — see the segmentation project guide for a step-by-step build. And if you're pricing out a managed switch alongside the rest of your gear, the price calculator keeps a running total as you shop.