Building a VLAN-Aware Home Network with a Cheap Managed Switch and OpenWrt

You don’t realize you need VLANs until a Wi-Fi camera phones home to China while your NAS sits on the same flat network. The fix isn’t enterprise hardware—a $40 managed switch and an OpenWrt router deliver proper 802.1Q segmentation for IoT, guest, and trusted traffic. That compromised smart bulb won’t reach your file server.

1. Understanding VLANs (the 30-Second Protocol Refresher)

VLANs separate broadcast domains at Layer 2, not just IP subnets. Without them, a broadcast from your thermostat reaches every device on the switch. With VLANs, that broadcast stays within its assigned group. 802.1Q tagging inserts a 4-byte tag into the Ethernet frame to identify which VLAN a packet belongs to.

A port can be tagged (passes frames with a VLAN tag, used for trunk links between switches or routers) or untagged (removes the tag before sending to the endpoint device). The PVID (Port VLAN ID) tells the switch which VLAN to assign to untagged frames arriving on that port. On the router side, OpenWrt handles VLANs via DSA (Distributed Switch Architecture) on modern kernels, or swconfig on older hardware. The router’s physical port becomes a trunk, and each VLAN gets its own virtual interface (e.g., eth0.10).

2. Hardware Choices: What “Cheap” Actually Buys You

A “managed switch” under $60 usually means a web-managed or “smart” switch with basic 802.1Q support. Realistic options: TP-Link TL-SG105E ($30–40), Netgear GS105E ($40–50), or Zyxel GS1200-5 ($50–60). Their web GUIs handle VLAN creation, port tagging, and PVID just fine. The trade-off: no VLAN isolation within the switch itself (no private VLANs), but that’s rarely needed for home use.

For the OpenWrt router, you need at least one physical Ethernet port that can become a trunk. Many consumer routers have a built-in switch (e.g., four LAN ports behind a single CPU interface), which complicates VLAN assignment—you may need to use one of those ports as a trunk by bridging or using DSA. A safer bet is a router with two separate Ethernet interfaces (like an x86 box or a device with a dedicated WAN port and a separate LAN port). The GL.iNet GL-MT6000 or a refurbished PC with a dual-port Intel NIC works well. Avoid routers with only a single combined WAN/LAN port unless you’re comfortable with VLANs on the CPU interface.

3. Planning Your VLAN Layout

Start simple. Here’s a layout that covers most home scenarios:

VLAN ID Name Subnet Devices
10 Main/Trusted 192.168.10.0/24 PCs, NAS, phones, laptops
20 IoT 192.168.20.0/24 Smart bulbs, cameras, thermostats
30 Guest 192.168.30.0/24 Visitors’ Wi-Fi
99 Management 192.168.99.0/24 Switch, router management

The switch tags packets; the router’s firewall zones enforce separation. VLAN 10 can reach everything, VLANs 20 and 30 only the internet (WAN), and VLAN 99 is locked down to the router and switch. Assign each device to its VLAN by plugging it into the correct switch port. Wi-Fi SSIDs map to VLANs via the access point—most consumer APs can’t do this, but a dedicated AP (like a used UniFi AC Lite) or an OpenWrt router with Wi-Fi can.

4. Configuring the OpenWrt Router

4.1 Create VLAN Interfaces in OpenWrt

In LuCI, navigate to Network → Interfaces, then Add new interface. Name it vlan10, choose protocol Static address, and set the device to eth0.10 (replace eth0 with your actual trunk port). Repeat for each VLAN. Alternatively, edit /etc/config/network:

config interface 'vlan10'
    option device 'eth0.10'
    option proto 'static'
    option ipaddr '192.168.10.1'
    option netmask '255.255.255.0'

config interface 'vlan20'
    option device 'eth0.20'
    option proto 'static'
    option ipaddr '192.168.20.1'
    option netmask '255.255.255.0'

Repeat for VLANs 30 and 99. The .10 suffix tells the kernel to tag frames with VLAN 10 on that physical port.

4.2 Assign Firewall Zones

Go to Network → Firewall, then Zones. Create a zone for each VLAN:

  • lan (VLAN 10): Allow forwarding to wan and vpn (if applicable).
  • iot (VLAN 20): Allow forwarding to wan only. Deny forwarding to lan and guest.
  • guest (VLAN 30): Allow forwarding to wan only. Deny all inter-zone.
  • mgmt (VLAN 99): Deny forwarding to all except wan (optional).

Set Input to reject for IoT and Guest zones, accept for Main. The default OpenWrt firewall rules block inter-zone traffic unless you explicitly allow it.

4.3 DHCP and DNS per VLAN

Under Network → Interfaces, edit each VLAN interface. Enable DHCP, set the start range (e.g., 192.168.10.100–.250 for Main), and optionally set a different DNS server for Guest (e.g., 1.1.1.1). For VLAN 99 (Management), set a static IP for the switch and router only—no DHCP needed.

5. Configuring the Managed Switch

5.1 Create VLANs and Set Port Mode

Using the switch’s web GUI (e.g., TP-Link Easy Smart Config or Netgear ProSAFE Plus Utility):

  1. Go to VLAN → 802.1Q VLAN.
  2. Create VLANs 10, 20, 30, and 99.
  3. For the port connected to your OpenWrt router (say port 5), set it as Tagged for all VLANs. This is the trunk.
  4. For device ports: - Port 1: Untagged member of VLAN 10. - Port 2: Untagged member of VLAN 20. - Port 3: Untagged member of VLAN 30. - Port 4: Untagged member of VLAN 99.

5.2 Configure PVID

Under the same VLAN settings, set the PVID for each port:

  • Port 1: PVID 10
  • Port 2: PVID 20
  • Port 3: PVID 30
  • Port 4: PVID 99
  • Port 5: PVID 1 (or leave default, since it’s a trunk)

PVID ensures untagged frames arriving on a port are assigned to the correct VLAN. Forgetting this step is the most common mistake—your device will end up in VLAN 1 by default.

5.3 (Optional) Enable VLAN Isolation on the Switch

Some switches (like the Zyxel GS1200-5) support port isolation. If yours does, enable it on IoT and Guest ports so devices within the same VLAN cannot talk to each other. This prevents a compromised camera from scanning other IoT devices. Check your switch’s manual—this feature is often called “port-based VLAN” or “isolation.”

6. Testing and Troubleshooting

Once configured, test with a device in each VLAN:

  1. Ping test: From a device on VLAN 20 (IoT), ping 192.168.10.1 (Main’s gateway). It should fail. Ping 8.8.8.8—should succeed. From a device on VLAN 10, ping both—should succeed.
  2. DHCP: Check that each device gets an IP in its correct subnet. If not, verify the PVID on the switch port and that the DHCP server is running on the correct VLAN interface.
  3. Packet capture: On the OpenWrt router, run tcpdump -i eth0 -e -n to see tagged frames. Look for vlan 10, vlan 20, etc. If you see untagged frames on the trunk, the switch isn’t tagging correctly.
  4. Common pitfalls: - Forgot PVID: Device gets IP from wrong subnet. - Trunk port set as untagged: Frames lose their tags, router sees them as VLAN 1. - Firewall zone defaults: OpenWrt’s default reject rules block all inter-zone traffic—good for IoT, but if you need Main to reach the NAS on VLAN 10, you must explicitly allow it. - Switch VLAN table not saved: Some cheap switches drop config on reboot. Save to flash (usually a button labeled “Save” or “Apply”).

Conclusion

A $40 managed switch and an OpenWrt router deliver enterprise-grade VLAN segmentation without the enterprise price tag. Start with two VLANs—Main and IoT—and expand to Guest and Management as you get comfortable. The switch handles the tagging, the router enforces the rules, and your NAS isn’t one compromised lightbulb away from disaster. Once you VLAN, you never go back.