Network Security • Home Lab Part 2

Network Segmentation & Security

Designed and configured a segmented home network that separates trusted users, lab systems, cameras, storage, management interfaces, and guests while allowing only the communication each zone requires.

pfSenseTP-Link Omada802.1Q VLANsKea DHCPFirewall policySuricatapfBlockerNGWireshark

View VLAN plan View Part 1

Architecture

Security boundaries built around device purpose.

Routing & Enforcement

pfSense provides WAN routing, NAT, DNS, DHCP, inter-VLAN routing, and policy enforcement through the LAN trunk.

Switching & Wireless

The managed Omada switch carries tagged VLAN traffic. Separate HOME and LAB SSIDs are delivered through their assigned EAP650 access points.

Protected Services

The NAS and cameras use dedicated networks. Explicit rules permit required recording and trusted-user access while reducing lateral movement.

Addressing plan

Six purpose-built network zones.

VLAN	Zone	Subnet	Primary purpose
10	HOME	192.168.10.0/24	Trusted household devices and wireless printer
20	LAB	192.168.20.0/24	Virtual machines, servers, and technical testing
30	CAMERAS	192.168.30.0/24	Two Reolink Duo 3 PoE cameras
40	NAS	192.168.40.0/24	Centralized storage, backups, and camera recordings
50	MGMT	192.168.50.0/24	pfSense, switch, controller, and AP administration
60	GUEST	192.168.60.0/24	Internet access for visitors without internal access

Switching design

Tagged trunks and dedicated access ports.

Firewall Trunk

Switch port 18 carries VLANs 10, 20, 30, 40, 50, and 60 between the switch and pfSense.

Access-Point Uplinks

Ports 2 and 3 connect the EAP650 access points. Management uses VLAN 50 while wireless traffic is assigned to the appropriate VLAN.

Wired Infrastructure

Dedicated access-port profiles place the NAS, cameras, and management devices directly into their assigned security zones.

Access policy

Permit required services; block unnecessary paths.

HOME

Internet access
Approved access to NAS services
Approved camera viewing and printer access
No infrastructure administration by default

CAMERAS

Restricted from initiating access to trusted user networks
Allowed to send recordings to the NAS
Only required camera and management services permitted

NAS

Accessible from authorized networks only
Service aliases simplify storage and camera-recording rules
Unnecessary lateral access is blocked

MGMT

Dedicated administration zone
Access to pfSense, switch, controller, APs, NAS, and cameras
Separated from ordinary user and guest traffic

LAB

Supports virtual machines and security exercises
Separated from production home devices
Controlled access added only when testing requires it

GUEST

Internet access
No access to private subnets
Isolated from trusted systems and infrastructure

Troubleshooting

Problems became evidence of practical network skills.

DHCP and VLAN Connectivity

Traced missing leases and intermittent connectivity to tagging, trunk membership, PVID, and native-VLAN mismatches across pfSense and Omada.

Management Migration

Investigated legacy VLAN 1 dependencies, moved infrastructure administration toward VLAN 50, and restored controller-to-AP connectivity after addressing changes.

Firewall and Service Validation

Tested inter-VLAN rules for HOME, NAS, CAMERAS, and MGMT; used logs, connectivity tests, and packet capture to distinguish firewall issues from endpoint application issues.

Security-Control Tuning

Evaluated Suricata behavior after legitimate management traffic was affected and adjusted the implementation approach to preserve availability while improving visibility.

Implementation evidence

Omada configuration and validation screenshots.

Select any screenshot to open the full-resolution version. The gallery documents the deployed topology, connected clients, wireless operation, VLAN views, and switch-port assignments.

Omada topology overview showing the gateway, two access points, controller, and managed switch — Initial Omada topology overview

Omada topology with infrastructure devices labeled — Labeled infrastructure topology

Expanded Omada topology showing access points, cameras, printer, and wired clients — Expanded device topology

Omada wireless client signal distribution dashboard — Wireless client signal distribution

Omada wireless traffic and channel utilization dashboard — Wireless traffic and channel utilization

Omada default VLAN topology view — Default VLAN topology

Omada switch-port map for the default VLAN — Default VLAN switch-port view

Omada switch-port map for the HOME VLAN — HOME VLAN switch-port view

Complete Omada network topology showing infrastructure and endpoint relationships — Complete deployed topology

Outcome

A working segmented environment with documented controls.

Technical Result

Home, lab, camera, NAS, management, and guest functions operate as separate zones with deliberate access paths.

Operational Result

The environment has a documented addressing scheme, switch-port design, service requirements, and troubleshooting history for repeatable changes.

Skills Demonstrated

Network design, VLAN trunking, firewall administration, DHCP, Wi-Fi segmentation, packet analysis, IDS/IPS evaluation, testing, and technical documentation.