Segmented Home Network

Context

This network redesign replaces a flat home LAN with intentional trust boundaries while keeping common workflows simple.

What I wanted to build

A network where lab services, trusted devices, guests, and experimental hardware do not all share the same level of access.

System design

VLANs separate device groups and firewall rules describe the few flows each group actually needs.

Hardware and software

The design uses existing routing and switching hardware with pfSense, WireGuard, and internal DNS.

Build process

I documented the required flows first, created one segment at a time, and tested name resolution and management access after each change.

Problems encountered

Rules that looked correct on paper could still break discovery protocols or management workflows.

How I solved them

I logged denied traffic, tested from the affected VLAN, and added narrow exceptions instead of broad allow rules.

Final result

Firewall rules are defined from a default-deny baseline. A small internal DNS zone gives services stable names, and WireGuard provides remote access to selected management interfaces without exposing them publicly.

What I learned

Network segmentation is as much a documentation problem as a firewall problem.

What I would improve next

I would automate configuration backups and keep a clearer diagram beside the rule set.