m4nifest0-tech

Search the site

Networking and network segmentation

Network, VLANs, and firewall

Network segmented into VLANs, with the firewall as the routing point between segments and a restrictive access policy.
ActiveUpdated on

Objective

Isolate management, servers, clients, home automation devices, and guests, limiting the flows between segments to those that are strictly necessary and documented.

Architecture

A perimeter firewall connects the network to the Internet and, through an 802.1Q trunk, to a managed switch and an access point. Five separate segments host management, servers, clients, home automation devices, and guests. Routing between segments goes through the firewall, with a restrictive default policy and documented allowed flows.

Network segmented with VLANsThe Internet reaches a perimeter firewall, connected by an 802.1Q trunk to a managed switch and, through the switch, to an access point. The management, server, and client segments branch off the switch; the access point serves the home automation and guest segments. Traffic between different segments goes through the firewall, which applies a restrictive policy.PerimeterNetwork coreVLAN segmentsInternetFirewalldefault denyManaged switchaccess and trunk portsAccess pointone Wi-Fi network per VLANManagement VLANadministration onlyServer VLANworkloadsClient VLANdesktops and laptopsHome automationVLANsmart devicesGuest VLANInternet access onlyWAN802.1Q trunktrunk
  • Internet is connected to Firewall (WAN)
  • Firewall is connected to Managed switch (802.1Q trunk)
  • Managed switch is connected to Access point (trunk)
  • Managed switch is connected to Management VLAN
  • Managed switch is connected to Server VLAN
  • Managed switch is connected to Client VLAN
  • Access point is connected to Home automation VLAN, logical link
  • Access point is connected to Guest VLAN, logical link
Network segmented with VLANs. The Internet reaches a perimeter firewall, connected by an 802.1Q trunk to a managed switch and, through the switch, to an access point. The management, server, and client segments branch off the switch; the access point serves the home automation and guest segments. Traffic between different segments goes through the firewall, which applies a restrictive policy.Solid line: direct connection. Dashed line: logical or secondary connection.

Details

Design principles

  • Segmentation: management, servers, clients, home automation devices, and guests sit in separate VLANs, so a compromised device cannot see the other segments.
  • A single control point: traffic between segments goes through the firewall, where it can be filtered and logged.
  • Restrictive policy: whatever is not explicitly allowed is blocked; exceptions are few, justified, and documented.
  • Isolated management: administrative interfaces are reachable only from the dedicated segment.
  • Guests and home automation: isolated from the work network and from the servers, with access limited to what is needed.
  • Basic services per segment: dedicated DHCP and DNS, with up-to-date documentation of the flows.

The underlying reasoning is illustrated in Segmenting the network with VLANs: a reference design for a homelab.

Change management

Every change to VLANs or rules follows the same cycle: request, change, verification of allowed and denied flows, saving the configuration, and updating the documentation.

Current setup

The firewall is a Nethesis Security Box S20 appliance running NethSecurity. The managed switch is an HP 1910-24G (JE006A), 24 10/100/1000 ports plus 4 SFP.

What is not published

By choice, this page does not list VLAN IDs, address ranges, the make or model of the access point, or firewall rules: a detailed description would help an attacker. The diagram uses only generic names.