this post was submitted on 10 Apr 2026
55 points (98.2% liked)

Selfhosted

60048 readers
734 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam.

  3. Posts here are to be centered around self-hosting. Please ensure it is clear in your post how it relates to self-hosting.

  4. Don't duplicate the full text of your blog or git here. Just post the link for folks to click.

  5. Submission headline should match the article title.

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
ayyy@sh.itjust.works
curbstickle@anarchist.nexus
curbstickle_lw@lemmy.world
55
Establishing proper VLAN's (lemmy.world)
submitted 2 months ago by koldanor@lemmy.world to c/selfhosted@lemmy.world
26 comments fedilink hide all child comments
 

Hey there selfhosted community.

I had big plans when I moved last year to finally setup my homelab with proper VLAN seperation. Well a stressfull move later I simply had no energy left and just threw my whole homelab and all my services in my main LAN with no seperation whatsoever.

In how much of a world of pain am I in now when I want to switch my homelab services over in a seperate VLAN? Any recomendations or pointers to documentation for me to go through before I decide if this is something I want to do right now?

Currently this would impact a proxmox host with 3 VM's and 1 LXC and around 20 docker images.

you are viewing a single comment's thread
view the rest of the comments
[–] 0x1050@lemmy.world 2 points 2 months ago

It really depends on how coupled your services are and how sparse you want to place them.

Are you learning VLANS? Heres my default setup anytime i set a home up:

10.0.10.0/24 my personal devices that I trust the most communicate with anything, but not administrative 10.0.20.0/24 wife/family members that may do stupid things. Communicate with most things 10.0.30.0/24 IoT Communicate with outside only 10.0.40.0/24 Guest. Communicate with some IoT 1.0.50.0/25 outside services. DMZ. All rfc 1918 blocked 1.0.90.0 /24 MGMT communicate everywhere. Administrative use only.

I run most services on .10.

Although I can log into anything from .10, its only to a non-administrative user to check in on basic stuff (is this service running? Did x drive not mount on boot?). Each host is configured to restrict ssh access to admin users to mgmt.

This means i have to switch VLAN to administrate services. It also means those users get less use and are easier to audit. Plus switching to 'network root' feels intentional.

You could get it done in an afternoon if you draw a map of the network and keep a tidy checklist. Seriously, map it out first. It'll serve as documentation you that you WILL need in the future.

Good luck with the build!