Building a HomeLab Network with VLANs and Managed Switches

Aussie households are pushing more devices onto the network than ever before, and the little white box your ISP hands you often can't keep up. Whether you're on the NBN HFC rollout in Brisbane or stuck with FTTN in Hobart, the modem-router combo that came in the post is usually a closed device running whatever firmware the carrier shipped that quarter. That makes it hard to carve your network into sensible pieces, which is where a proper home lab with VLANs and a managed switch earns its keep. Learn more about 自作pcでストレージの内部共有と外付けバックアップの運用を見直してデータを守る方法.

The good news is that building one doesn't require a server room or a six-figure budget. A modest rack in the garage, a handful of second-hand enterprise switches from the local Computer Alliance clearance list, and a router you're willing to tinker with is enough to get real segmentation, decent speeds, and a network you actually understand. The trick is knowing where to start and what trade-offs to expect along the way.

Planning your home lab layout

Before you buy a single piece of gear, sketch what you're trying to separate. Most home lab builders in Australia end up with something like a trusted zone for laptops and phones, a guest network for the in-laws when they visit, an IoT segment for the smart lights and the LG fridge, a lab segment full of half-finished Kubernetes clusters, and a management VLAN that only your switch and router sit on. The exact names don't matter, but the habit of writing them down does.

A solid plan also accounts for where everything physically lives. If you're in a Queenslander in Paddington, the lab might end up under the house where it's cooler in summer but harder to reach. A townhouse in Parramatta might have a dedicated cupboard. Either way, think about airflow, length of Cat6A runs, and whether you'll need to drill through double brick to get cables upstairs. Planning cable paths before you order gear saves an arvo of swearing at a fish tape.

Picking the right managed switch

The Australian market has caught up with the rest of the world on managed switches, and you no longer need to import anything dodgy. MikroTik gear is popular with the homelab crowd because the price-to-port ratio is hard to beat, and the RouterOS learning curve, while steep, rewards the effort. TP-Link Omada and UniFi are the friendlier options if you'd rather configure everything from a web GUI without reading forums at midnight.

For a starter build, a 24-port gigabit managed switch with a handful of SFP+ uplink ports gives you plenty of room to grow. Look for 802.1Q VLAN support, basic ACLs, and ideally a web interface that doesn't time out every two minutes. If your homelab ever escalates to 10-gig networking, picking a switch with SFP+ now means you won't be replacing it in twelve months. The DIY storage backup design discussion in the linked piece also touches on the value of choosing hardware that ages well, since backup infrastructure lives alongside your switching gear for years.

Configuring VLANs on the switch

Once the switch is racked, the real work begins. Each port gets assigned to either an access VLAN (one VLAN only) or a trunk port carrying tagged traffic for several VLANs at once. The trick is to keep the trunk port isolated to the one link between your switch and your router/firewall, and to make sure every other port is an access port with the correct PVID set. Forgetting to untag the native VLAN on a trunk can lead to a quiet Saturday of debugging when devices on two different VLANs start chatting to each other.

VLAN IDs themselves are arbitrary, but it's worth picking a scheme you can remember. Many Australian homelabbers follow the convention of starting at VLAN 10 for trusted, 20 for IoT, 30 for guest, 40 for lab, and 99 for management, but you could just as easily start at 100. The point is consistency, especially if you ever expand to a second switch later. Tag the trunk between switches the same way, and document the layout in a text file on your NAS, not just in your head.

Routing between VLANs with pfSense or OPNsense

A managed switch alone doesn't actually route traffic between VLANs; you need a router or layer-3 device for that. The most common path in Aussie homelabs is to run pfSense or OPNsense on a small x86 box with two NICs (or a VLAN-aware single NIC if your switch supports it). You create a parent interface, assign VLAN sub-interfaces, hand out DHCP ranges for each one, and write firewall rules that say, for instance, that IoT can reach the internet but not your NAS.

The "router-on-a-stick" approach, where a single trunk cable carries all VLANs to the firewall, is space-efficient and works well for modest setups. If you're running heavier workloads, consider an L3 switch to take inter-VLAN routing off the firewall entirely, then keep the firewall focused on WAN and security policy. There's a neat write-up on using F# state machine logic to model firewall rule transitions if you want to take a more software-driven approach to network state, which is a fun rabbit hole to disappear into on a wet Melbourne weekend.

Cabling, racks, and dealing with Australian conditions

A 6RU wall-mount rack from a local supplier like CableMate or Cabac will hold a patch panel, switch, firewall, and small NAS without dominating a study. Run solid-core Cat6A for permanent links and stranded patch leads for the moving parts. Label both ends of every cable, because future-you will not remember which blue lead goes to the study and which one goes to the spare room. A simple Brother P-touch or a roll of coloured tape does the job.

Heat and dust are the two enemies of any home lab in Australia. A garage in Adelaide can hit 45 degrees in February, and a closet without ventilation will cook a switch in a hurry. If your rack lives somewhere warm, add a couple of quiet 120mm fans at the bottom to push air through. Dust is harder: a cheap foam filter taped over the intake will save you a service later. A UPS isn't optional either, since summer storms in Sydney and Brisbane will take out a suburb's worth of FTTN nodes without warning, and your gear will go down with them.

Common gotchas and ongoing maintenance

Even a well-planned VLAN setup develops quirks over time. The most common one is asymmetric routing, where traffic leaves one VLAN through the firewall but comes back through a different path, breaking things like VoIP and online games. The fix is almost always to police your inter-VLAN rules strictly and avoid clever shortcuts that span multiple subnets. Another classic is forgetting that mDNS doesn't cross VLAN boundaries, which is why your AirPlay printer stops working the day you segment the network. Solutions like Avahi reflectors or a small Unifi controller can bridge the gap if needed.

Treat the network as a living system. Keep a config backup of the switch and firewall, ideally version-controlled in a private git repo, and test restores on a Sunday before something breaks for real. Once a quarter, walk through the rules and prune anything stale. A homelab is meant to be a learning space, so the mess of half-finished projects is part of the deal, but the core network underneath should stay clean and predictable.

If your home network is creeping past the point of a weekend project, or you're about to migrate a small business to segmented infrastructure and want a second opinion, get in touch. Karl works with Australian small businesses and home-lab enthusiasts on infrastructure planning, cloud migration, and systems architecture, and is happy to chat through options, drop a quote, or point you at a useful contact if the engagement isn't quite the right fit.