In larger networks VLANs let you do network segmentation across switches, which you can't really do otherwise.
I wouldn't bother at home.
Comment on Should I or should I not use a VLAN? I have trouble understanding the benefits for home use
rentar42@kbin.social 6 months ago
Like many other security mechanisms VLANs aren't really about enabling anything that can't be done about them.
Instead it's almost exclusively about FORBIDDING some kinds of interactions that are otherwise allowed by default.
So if your question is "do I need VLAN to enable any features", then the answer is no, you don't (almost certainly, I'm sure there are some weird corner cases and exceptions).
What VLANs can help you do is stop your PoE camera from talking to your KNX and your Chromecast from talking to your Switch. But why would you want that? They don't normally talk to each other anyway. Right. That "normally" is exactly the case: one major benefit of having VLANs is not just stopping "normal" phone-homes but to contain any security incidents to as small a scope as possible. Imagine if someone figured out a way to hack your switch (maybe even remotely while you're out!). That would be bad. What would be worse is if that attacker then suddenly has access to your pihole (which is password protected and the password never flies around your home network unencrypted, right?!) or your PC or your phone ...
So having separate VLANs where each one contains only devices that need to talk to each other can severely restrict the actual impact of a security issue with any of your devices.
FalseMyrmidon@kbin.run 6 months ago
Sethayy@sh.itjust.works 6 months ago
Just for an anecdote on functional vlans, I once knew someone that had their WAN sent into a managed switch, set it on a vlan with their router elsewhere in the network
BlueEther@no.lastname.nz 6 months ago
I had my home setup like that for years. ONT <-> Switch <-> Opnsense <-> Back to Switch
4am@lemm.ee 6 months ago
And, circling back to ports, you can make firewall rules that prevent devices from talking across VLANs on certain ports. Your Nintendo Switch doesn’t need SSH access to your KNX server, to re-use your previous example, so you block your console’s VLAN from being able to talk to your server VLAN at all.