Skip to content

VLAN Design

OPNsense VLAN configuration for network segmentation and IoT isolation.

Overview

                          [ISP Modem]
                               │
                        [OPNsense VM]
                         (Mini PC)
                               │
                    ┌──────────┼──────────┐
                    │          │          │
              VLAN 1      VLAN 10     VLAN 20
            Management      IoT       Guest
           192.168.0.0  192.168.10.0 192.168.20.0
                │          │          │
           ┌────┴────┐     │     ┌────┴────┐
           │         │     │     │         │
        [Servers] [Admin]  │  [Phones]  [Visitors]
                           │
                    ┌──────┴──────┐
                    │             │
               [Cameras]    [Smart Home]

VLAN Assignments

VLAN ID Name Subnet Purpose
1 Management 192.168.0.0/24 Servers, admin devices
10 IoT 192.168.10.0/24 Cameras, smart devices
20 Guest 192.168.20.0/24 Untrusted devices, visitors

Device Placement

VLAN 1 - Management (192.168.0.0/24)

Trusted devices with full network access.

Device IP Connection Notes
Proxmox (OPNsense + Docker VM) .1 / .10 MokerLink P1 Trunk — both VMs share nic1/vmbr1
RPi 4 (Start9) .11 MokerLink P2 Bitcoin node
RPi 5 (openclaw) .20 MokerLink P3 AI assistant
NAS .12 MokerLink P4 Storage, backups
Yamaha RX-V671 .30 MokerLink P5 AV Receiver (Ethernet)
TP-Link AP - MokerLink P7 VLAN trunk
Apple TV .31 WiFi (HomeNet) Jellyfin client
LG Smart TV .32 WiFi (HomeNet) Jellyfin client
MacBook DHCP MokerLink P8 Admin workstation
Phones DHCP WiFi (HomeNet) Family devices

VLAN 10 - IoT (192.168.10.0/24)

Untrusted IoT devices. No internet access by default.

Device IP Notes
Reolink Cam 1 .101 Front door
Reolink Cam 2 .102 Back yard
Tapo C110 .103 Indoor (WiFi)
Smart bulbs DHCP If added
Smart plugs DHCP If added

VLAN 20 - Guest (192.168.20.0/24)

Internet-only access. No LAN access.

Device IP Notes
Guest phones DHCP Visitors
Guest laptops DHCP Visitors

OPNsense Configuration

1. Create VLANs

Interfaces → Other Types → VLAN

Parent VLAN Tag Description
vtnet1 (LAN) 10 IoT
vtnet1 (LAN) 20 Guest

2. Assign Interfaces

Interfaces → Assignments

Interface Device Description
LAN vtnet1 Management (untagged)
IOT vtnet1.10 IoT VLAN
GUEST vtnet1.20 Guest VLAN

3. Configure Interface IPs

Interface IPv4 DHCP Range
LAN 192.168.0.1/24 .100-.199
IOT 192.168.10.1/24 .100-.199
GUEST 192.168.20.1/24 .100-.199

4. Enable DHCP

Services → DHCPv4

For each interface:

  • Enable DHCP
  • Set range: .100 to .199
  • DNS: Point to Pi-hole (192.168.0.10)

Firewall Rules

Management VLAN (LAN)

# Action Source Destination Ports Description
1 Pass LAN net any any Allow all outbound

IoT VLAN

# Action Source Destination Ports Description
1 Pass IOT net 192.168.0.10 53 Allow DNS (Pi-hole)
2 Pass IOT net 192.168.0.10 123 Allow NTP
3 Pass 192.168.10.101-103 192.168.0.10 5000 Cameras → Frigate
4 Block IOT net RFC1918 any Block LAN access
5 Block IOT net any any Block internet (default deny)

Camera-specific rules: Cameras only need to reach Frigate, no internet.

Guest VLAN

# Action Source Destination Ports Description
1 Pass GUEST net 192.168.0.10 53 Allow DNS
2 Block GUEST net RFC1918 any Block LAN access
3 Pass GUEST net any 80,443 Allow HTTP/HTTPS
4 Block GUEST net any any Block all else

Switch Configuration

Configure for VLAN trunking:

Port Mode VLAN Device Speed
1 Trunk 1,10,20 Proxmox (OPNsense + Docker VM) 2.5G
2 Access 1 RPi 4 (Start9) 1G
3 Access 1 RPi 5 (OpenClaw) 1G
4 Access 1 NAS 2.5G
5 Access 1 Yamaha RX-V671 1G
6 Access 10 TP-Link PoE Switch 1G
7 Trunk 1,10,20 TP-Link AP 1G
8 Access 1 Reserved (MacBook) 2.5G

Note: Port 1 is a trunk because Proxmox's vmbr1 bridge carries both OPNsense VLAN-tagged traffic (10, 20) and Docker VM untagged traffic (VLAN 1). OPNsense handles tagging internally via vtnet1 sub-interfaces (vtnet1.10, vtnet1.20).

Configure in the switch web UI (http://192.168.1.2):

VLAN ID Tagged (trunk) Untagged (access)
1 P1, P7 P2, P3, P4, P5, P8
10 P1, P7 P6
20 P1, P7 —

Each port's PVID determines which VLAN untagged incoming traffic is assigned to:

Port PVID
1 1
2 1
3 1
4 1
5 1
6 10
7 1
8 1

Unmanaged switch - all ports share same VLAN (10, inherited from MokerLink P6).

Port Device IP
1 Uplink to MokerLink P6 -
2 Reolink Cam 1 192.168.10.101
3 Reolink Cam 2 192.168.10.102
4-5 Reserved -

All cameras automatically on VLAN 10 (IoT) without per-port config.

WiFi Configuration

SSID VLAN Purpose
HomeNet 1 Trusted devices
IoT-Devices 10 Smart home (if supported)
Guest 20 Visitors

Note: Stock firmware may not support multi-VLAN. Options:

  • Single SSID on Management VLAN
  • Flash OpenWrt for full VLAN support

Camera Isolation

Security Model

┌─────────────────────────────────────────────────────┐
│                   IoT VLAN (10)                      │
│                                                      │
│   [Cam 1]    [Cam 2]    [Cam 3]                     │
│   .101       .102       .103                         │
│      │          │          │                         │
│      └──────────┼──────────┘                         │
│                 │                                    │
│           Only allowed to:                           │
│           192.168.0.10:5000 (Frigate)               │
│                                                      │
│           ✗ No internet                             │
│           ✗ No LAN access                           │
│           ✗ No camera-to-camera                     │
└─────────────────────────────────────────────────────┘

Why Isolate Cameras?

  • Prevent firmware phone-home to China
  • Block network scanning/attacks
  • Contain compromised devices
  • RTSP streams stay local

Tailscale Bypass

Tailscale devices access services via overlay network, bypassing VLANs:

Tailscale IP Device Physical VLAN
100.68.63.168 Docker VM 1
100.64.0.11 RPi 4 1
100.82.77.97 NAS 1

Access from anywhere: ssh 100.82.77.97 works regardless of VLAN.

Implementation Checklist

Phase 1: OPNsense

  • [x] Create VLAN 10 (IoT)
  • [x] Create VLAN 20 (Guest)
  • [x] Assign interfaces
  • [x] Configure DHCP per VLAN
  • [x] Create firewall rules

Phase 2: Switch

  • [x] Configure MokerLink VLAN trunks
  • [x] Configure access ports
  • [x] Connect PoE switch to IoT VLAN

Phase 3: Cameras

  • [ ] Assign static IPs (.101-.103)
  • [ ] Verify Frigate connectivity
  • [ ] Confirm no internet access

Phase 4: WiFi (Optional)

  • [ ] Create Guest SSID
  • [ ] Map to VLAN 20
  • [ ] Test isolation

Troubleshooting

Device Can't Get IP

# Check DHCP leases in OPNsense
Services → DHCPv4 → Leases

# Verify VLAN tagging matches switch config

Camera Can't Reach Frigate

# Check firewall logs
Firewall → Log Files → Live View

# Verify rule allows IoT → 192.168.0.10:5000

Inter-VLAN Traffic Blocked

# Expected behavior!
# Only explicitly allowed traffic passes between VLANs

Reference