Network Segmentation

Everything on your home network currently shares one broadcast domain by default - your smart plugs, your laptop, guests' phones, and your homelab all sit on the same flat network and can, in principle, talk to each other. Segmentation is about deliberately breaking that up.

Why bother

IoT devices have famously bad security track records. A cheap smart bulb or camera with unpatched firmware is a realistic entry point onto your network. It doesn't need to reach your NAS or Proxmox host to be useful to you - so don't let it.
Guests shouldn't see your infrastructure. A guest Wi-Fi network should get internet access and nothing else.
Blast radius matters. If any one segment is compromised, the damage should stop at that segment's boundary, not spread to everything you own.

VLANs, in practice

A VLAN tags traffic with a numeric ID so a single physical switch and set of cables can carry multiple logically separate networks at once - no separate wiring required. A managed switch (one that supports VLAN tagging, as opposed to an unmanaged switch that just passes everything through) and a router/firewall capable of routing between VLANs are the two pieces of hardware this actually requires.

A workable starting layout:

VLAN 10 - Trusted - your main devices, laptops, phones you use day to day.
VLAN 20 - Homelab - Proxmox and everything running on it.
VLAN 30 - IoT - smart home devices, cameras, anything closed-source and rarely updated.
VLAN 40 - Guest - internet-only, isolated from everything else.

Numbers and names are arbitrary - what matters is the isolation, not matching this exact scheme.

Managed switch basics

On a managed switch, each port is either:

Access port - untagged, belongs to exactly one VLAN. Use for end devices that don't understand VLAN tagging themselves (most consumer gear, IoT devices, unmanaged access points on a single SSID).
Trunk port - carries multiple tagged VLANs over one cable. Use between switches, and to a Proxmox host or a router that needs to see multiple VLANs.

Your Wi-Fi access point, if it supports multiple SSIDs mapped to different VLANs, plugs into a trunk port; each SSID (e.g. "Home" vs "Home-IoT" vs "Home-Guest") tags its traffic with the matching VLAN ID as it leaves the AP.

Proxmox's virtual bridge and VLAN-aware setup

Proxmox networks guests through a Linux bridge (vmbr0 by default), which behaves like a virtual switch. Enable VLAN aware on that bridge (Datacenter > Node > Network > vmbr0 > Edit > VLAN aware), and you can assign a VLAN tag per guest's network interface instead of creating a separate bridge per VLAN:

Guest network device:
  Bridge: vmbr0
  VLAN Tag: 20

That guest now only sees traffic on VLAN 20, using the same physical NIC and trunk port as every other VLAN on the host. This is the practical reason a VLAN-aware bridge is worth setting up early - it means adding a new VLAN later is a dropdown change, not a cabling project.

⚠️ Risk: the physical port your Proxmox host plugs into must be configured as a trunk port carrying all the VLANs you intend to use, or guests on non-native VLANs simply won't get traffic. Confirm switch-side trunk configuration before troubleshooting Proxmox further if a VLAN-tagged guest can't reach the network.

Firewall rules between segments

VLANs alone only separate broadcast domains - by default, most routers will still happily route traffic between them. The isolation you actually want (IoT can't reach Homelab) needs explicit firewall rules on your router/firewall denying that inter-VLAN traffic, with narrow exceptions where genuinely needed (e.g. allowing your trusted VLAN to reach the homelab VLAN, but not the reverse).

Consumer routers vary wildly in whether they expose this. If yours doesn't support VLANs and inter-VLAN firewall rules at all, that's a sign to look at a dedicated router/firewall - covered further in Advanced Networking if you want to go deeper than a home router's built-in capabilities.

Next: Reverse Proxy and TLS.