A virtual local area network (VLAN) is exactly what the name suggests. It's the same as a physical LAN, just in a virtual sense. VLANs are a technology that can be configured on top of network infrastructure to create virtual networks that can be separate from each other. Think of it as multiple home networks, but with the same equipment. A router can merge VLANs to allow sharing of services (printers, Network Attached Storage (NAS), IoT devices) as well as access to certain hardware on both networks. I'll go through some reasons why you should consider introducing VLANs on your home network.
1 Creating multiple virtual networks
A VLAN is not only good for keeping clients separate, it's also handy for creating a guest network. Maybe you don't want everyone connecting to your home network and discovering everything connected to your LAN. That's where a VLAN comes in. You can limit exactly how much of the network a VLAN can access, which can help limit a particular client's access. It's also less expensive. You don't need to buy multiple routers, switches, and access points. Just configure the VLAN accordingly and your existing hardware will do the rest.
Services on the network can be shared across VLANs so that everyone can use the same printer, NAS, and other connected hardware.
2 Improved safety through isolation
Another handy feature of VLANs is increased security. VLANs are, by design, isolated from each other. This helps keep clients separate depending on which VLAN they are connected to. By enabling a demilitarized zone (DMZ), you can minimize the damage from potential attacks while still running web servers and other services that require external access. Running such front-end services can open your LAN to untrusted traffic. This is where a DMZ comes in handy by filtering traffic between the VLAN and the main network. Clients on the LAN can connect to the Internet and authorized external access to the LAN can be allowed.
Routers and switches may even allow you to specify which VLANs are used by which port. A VLAN can have a completely different subnet and a router can be configured to allow traffic between the virtual networks through inter-VLAN routing. It is important to note, however, that a VLAN does not protect your network as a whole. Firewalls, access lists and other security measures should still be used to keep clients safe.
3 Improved reliability for testing and home labs
When you're fiddling around with technology, things can go wrong. This is usually not a problem, as troubleshooting and working out a solution is part of the fun. However, this is not the view of other family members who can also be affected by downtime. If your network goes down for some reason while you're trying to make changes to the router/firewall, move physical devices, or work on other parts of the LAN, it can cause problems for everyone else trying to access the Internet or other services on the local network. This is where a VLAN can help.
Having a VLAN configured for testing and other tasks allows you to isolate yourself from active traffic even if you are using the same hardware. A handy tip, especially if you plan on running servers and homelab stuff, is to document as much as possible. Simple reference guides and maps of your network and how it all works are essential for troubleshooting and future work on the LAN.
Create your VLAN today!
There's a good chance that the router you use at home doesn't support the creation of VLANs. It's usually marketed as a prosumer or business feature and can be found on aftermarket routers and other networking hardware. You can either build a custom router yourself using software like pfSense or use hardware from a brand like Ubiquiti.