vlan segmentation, contain the blast radius

the smart bulb problem

somebody buys a smart bulb. plugs it into wifi. now that fifteen dollar bulb is sitting on the exact same network as their laptop, their nas, their work vpn session, everything. the bulb gets popped because iot firmware is usually garbage, and suddenly the attacker isn't in "the bulb," they're in your network. one flat network means one compromise equals total access. that's the whole problem this post is about fixing.

what a flat network actually looks like

most home and small office networks are one big broadcast domain. your laptop, your phone, your printer, your smart plugs, your guest's phone when they ask for the wifi password, all of it lives on the same subnet and can talk to each other freely. there's no wall anywhere. if one device gets infected, it can scan, sniff, and try to reach every other device on that same subnet because nothing is stopping it.

this is why "the blast radius" matters as a phrase. a breach isn't binary, it's not "safe" or "owned." it's a radius. the question is how far it spreads before it hits something that stops it. a flat network has an infinite radius. segmentation puts walls in that radius.

the fix: split things into vlans

a vlan (virtual lan) lets you logically separate devices even if they're plugged into the same physical switch. instead of one big group, you build separate groups based on trust level and function:

vlan 10 - users (laptops, phones you trust)
vlan 20 - servers (nas, home lab, anything with real data)
vlan 30 - iot (bulbs, cameras, smart plugs, that weird robot vacuum)
vlan 40 - guests (anyone who's not you)

each vlan is its own broadcast domain. a device on vlan 30 physically cannot chat with a device on vlan 20 unless something explicitly routes traffic between them. this alone kills most lateral movement, because the malware on your smart bulb has nowhere to go. it can see other bulbs. that's it.

routing between vlans without opening the floodgates

vlans don't talk to each other on their own, you need an l3 switch or router to move traffic between them, and this is where the actual security work happens. you don't just route everything to everything, you write access control lists (acls) that define who is allowed to initiate what.

a reasonable ruleset looks like this:

users -> servers: allow (you need to reach your nas)
users -> iot: allow (you need to control your bulbs)
iot -> servers: deny (bulbs have no business touching your nas)
iot -> users: deny
guests -> internet: allow
guests -> everything else: deny

the key insight is that access should be directional and specific, not "these two vlans can talk." your phone can reach the smart bulb to turn it on. the smart bulb has zero reason to ever initiate a connection to your nas, your laptop, or your work files, so that path gets an explicit deny. if the bulb gets compromised, the attacker is stuck in a dead end vlan with nothing valuable in reach.

guest wifi is the easiest win here

if you do nothing else, put guests on their own vlan with internet-only access. this is the segmentation project with the best return for the least effort. anyone connecting to guest wifi, their kid's tablet, a visiting friend's laptop, a device you know nothing about, gets a straight line to the internet and nothing else. no visibility into your internal network, no ability to scan your devices, no path to your servers. most consumer routers actually support a "guest network" toggle that does exactly this, it's just often left off by default.

the takeaway

segmentation doesn't stop every attack, it stops attacks from spreading. the smart bulb still might get compromised, iot firmware is still garbage, that part doesn't change. what changes is what happens next. instead of an attacker pivoting from a bulb to your nas to your laptop to your backups, they hit a wall and stay stuck in a vlan full of other bulbs. go look at your own network right now. if your smart plug and your nas are on the same subnet, that's your starting point. build the vlans, write the acls, put guests on their own island, and give your future incident response a much smaller mess to clean up.