VLANs need firewall policy
Different VLAN IDs provide little security if the router allows all inter-VLAN routing. Give each VLAN a subnet and DHCP scope, then define explicit firewall policy.
| Network | Examples | Baseline policy |
|---|---|---|
| Trusted | PCs and phones | Internet plus required NAS services |
| IoT | TVs, speakers, appliances | Internet; block new sessions toward Trusted |
| Guest | Visitors | Internet only, block LAN, isolate clients |
| Management | Router, switches and APs | Only administrator devices |
Map ports and SSIDs
- Router-switch-AP uplinks are trunks carrying tagged VLANs.
- A normal endpoint port is an untagged/access member of one VLAN.
- Map SSIDs to VLANs, but avoid excessive SSIDs because management frames consume airtime.
Service exceptions
Discovery for AirPlay, Chromecast or IoT control may need an mDNS reflector and narrow firewall exceptions. Prefer exact sources, destinations and ports over broad bidirectional access.
Before rollout
- Keep a safe wired management port
- Back up the current configuration
- Verify DHCP and DNS in every VLAN
- Test that IoT cannot initiate toward Trusted
- Test guest isolation from LAN and other guests