Agent skill · security · affaan-m
homelab-vlan-segmentation
Segmenting home networks into VLANs for IoT, guest, trusted, and server traffic using UniFi, pfSense/OPNsense, and MikroTik — including switch trunk config, firewall rules, and wireless SSID mapping. Use when splitting a home network into IoT, guest, trusted, and server VLANs on UniFi, pfSense/OPNsense, or MikroTik.
Why this skill is useful
Provides specific firewall rules and VLAN configurations for UniFi, pfSense/OPNsense, and MikroTik that the AI wouldn't reliably generate on its own.
What it needs
About 6k tokens when loaded. Last updated 2026-08-06. 238,342 stars on the source repository.
What this skill does
Homelab VLAN Segmentation How to split a home network into isolated VLANs so IoT devices, guests, and your main PCs cannot talk to each other. The most impactful security upgrade for a home network. All firewall rules shown here add isolation between segments — they do not remove existing protections. Apply changes in a maintenance window and verify connectivity between segments after each step before moving on. When to Use Setting up VLANs on a home network for the first time Isolating IoT devices (smart bulbs, cameras, TVs) from trusted devices Creating a guest Wi-Fi network that cannot reach home devices Explaining how VLANs work to someone unfamiliar with the concept Configuring trunk ports, access ports, and SSID-to-VLAN mapping Troubleshooting inter-VLAN routing or firewall rule issues on pfSense/OPNsense/UniFi How It Works VLAN Design Template Examples Typical homelab with UniFi AP and managed switch: UniFi Configuration Create Networks in UniFi Controller Map SSIDs to VLANs (UniFi) UniFi Firewall Rules (Traffic Rules) pfSense / OPNsense Configuration Create VLANs DHCP for Each VLAN Firewall Rules (pfSense/OPNsense) MikroTik Configuration Switch Trunk vs Access Ports Anti-Patterns Best Practices Start with 4 VLANs: Trusted, IoT, Servers, Guest — add more as needed Put Pi-hole in the Servers VLAN (192.168.30.x) Add a firewall rule allowing DNS (port 53) from all VLANs to the Pi-hole IP — before any RFC1918 block rule Test isolation after every rule change: from the IoT VLAN, try to ping a trusted device — it should fail Use a management VLAN for switch and AP web UIs and restrict access to the Trusted VLAN only Document your VLAN design in a table (VLAN ID, name, subnet, purpose) Related Skills homelab-network-setup homelab-pihole-dns homelab-wireguard-vpn
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills affaan-m/homelab-vlan-segmentation--ba2cc8