Migrating from a flat network to VLANs
Leaping straight into setting up a homelab and setting up applications and services is the quickest way to get to the fun part. Early planning prevents having to redo work later on, especially if you've already deployed a lot of services that will have to be reconfigured. That is where I found myself this past week. My homelab started with the basic idea of setting up Proxmox on my old gaming PC to test Docker Swarm, Traefik, and Pi-Hole. Before I stopped to think about it, I had acquired two mini PCs and a surplus HP EliteDesk. All four compute nodes running Proxmox, Linux VMs with Docker Swarm, and several service stacks.
Setting a goal
Before I get too much farther, it's time to pause, set my goals, and write a plan. The overall goal is fairly straight forward. I want to learn. Straight forward Johnny 5 from Short Circuit. The homelab will play a central part in may of the projects I have planned. With that in mind, the current primary goal is to have the homelab configured in a secured way to protect my personal devices, function as a sandbox for testing services, and be ready to host services for my other projects as needed.
Creating a plan
There are two ways I can start working towards the goal. Wipe everything and start clean or creating a plan to reconfigure the lab as it currently exists. Based on the title of this page, I have chosen to write a plan to reconfigure the homelab as it exists now. The first item to plan for in the homelab will be proper network configuration. I will accomplish this using VLANs. VLANs will allow me to seprate and secure network traffic that only devices and services that need to communicate with eachother will be allowed to. The table below is an example of my planned VLAN configuration:
| VLAN_ID | Network | Name | Description |
|---|---|---|---|
| 1 | 192.168.1.0/24 | Management | Network and Hypervisors |
| 10 | 192.168.10.0/24 | Main/Trusted | Personal Devices |
| 20 | 192.168.20.0/24 | IoT | Smart plugs, Garden Automation |
| 30 | 192.168.30.0/24 | Guest | Untrusted Devices |
| 40 | 192.168.40.0/24 | HomeLab | Docker Swarm, GitLab (eventually), n8n. |
| 50 | 192.168.50.0/24 | Security | NVR WAN port. |
| 60 | 192.168.60.0/24 | Experimental | Meshtastic MQTT bridges, SDR stuff. |
Depending on your network equipment, VLANs may be handled differently. In the Cisco world, the assignment types you'd look into would be access or trunk ports. I am using Unifi equipment in my homelab. VLANs are configured as native, tagged, or untagged. For a port that only needs to communicate on a single VLAN, such as a security camera, will be tagged as native for VLAN 50.
Since the network equipment and Proxmox hosts are already on the default, VLAN 1, no changes are necessary there.