Agent skill · security · affaan-m
homelab-vlan-segmentation
Segmenting home networks into VLANs for IoT, guest, trusted, and server traffic using UniFi, pfSense/OPNsense, and MikroTik — including switch trunk config, firewall rules, and wireless SSID mapping. Use when splitting a home network into IoT, guest, trusted, and server VLANs on UniFi, pfSense/OPNsense, or MikroTik.
Why this skill is useful
Provides detailed VLAN configuration templates and firewall rules specific to home networking that the AI wouldn't reliably generate on its own.
What it needs
About 6k tokens when loaded. Last updated 2026-08-06. 238,342 stars on the source repository.
What this skill does
Homelab VLAN Segmentation How to split a home network into isolated VLANs so IoT devices, guests, and your main PCs cannot talk to each other. The most impactful security upgrade for a home network. All firewall rules shown here add isolation between segments — they do not remove existing protections. Apply changes in a maintenance window and verify connectivity between segments after each step before moving on. When to Use Setting up VLANs on a home network for the first time Isolating IoT devices (smart bulbs, cameras, TVs) from trusted devices Creating a guest Wi-Fi network that cannot reach home devices Explaining how VLANs work to someone unfamiliar with the concept Configuring trunk ports, access ports, and SSID-to-VLAN mapping Troubleshooting inter-VLAN routing or firewall rule issues on pfSense/OPNsense/UniFi How It Works VLAN Design Template Examples Typical homelab with UniFi AP and managed switch: UniFi Configuration Create Networks in UniFi Controller Map SSIDs to VLANs (UniFi) UniFi Firewall Rules (Traffic Rules) pfSense / OPNsense Configuration Create VLANs DHCP for Each VLAN Firewall Rules (pfSense/OPNsense) MikroTik Configuration Switch Trunk vs Access Ports Anti-Patterns Best Practices Start with 4 VLANs: Trusted, IoT, Servers, Guest — add more as needed Put Pi-hole in the Servers VLAN (192.168.30.x) Add a firewall rule allowing DNS (port 53) from all VLANs to the Pi-hole IP — before any RFC1918 block rule Test isolation after every rule change: from the IoT VLAN, try to ping a trusted device — it should fail Use a management VLAN for switch and AP web UIs and restrict access to the Trusted VLAN only Document your VLAN design in a table (VLAN ID, name, subnet, purpose) Related Skills homelab-network-setup homelab-pihole-dns homelab-wireguard-vpn
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills affaan-m/homelab-vlan-segmentation--bcfae5