Home Lab Network Diagram: VLANs, Firewall, Reverse Proxy and Self-Hosted Services

Most home labs start flat: a Raspberry Pi running Pi-hole, a NAS, a mini PC with Proxmox and a dozen containers, all on the 192.168.1.0/24 network the ISP router handed out. The smart TV and a camera that no longer gets firmware updates share it with your NAS admin page, and the Jellyfin port forward from two years ago is still open.

This post designs a home lab network that isolates IoT and guests, exposes services safely and is easy to recover, then draws it.

What the network has to do

• Isolation. TVs, cameras and guest phones reach the internet, not your NAS or hypervisor.
• Safe exposure. One authenticated, encrypted way in, not a port per service.
• Recoverability. When a disk dies, you rebuild from backups and a diagram, not memory.

The hardware: an ISP modem in bridge mode, so there is no double NAT; an OPNsense or pfSense CE firewall, both open source, routing between VLANs and running DHCP, DNS and VPNs; a managed switch with 802.1Q VLAN support; an access point that maps SSIDs to VLANs; a Proxmox VE host for VMs and LXC containers; and a NAS.

The VLAN plan

Pick one /16 from the RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and give each VLAN a /24. Avoid 192.168.0.0/24 and 192.168.1.0/24, common on networks you will connect home from, plus 172.17.0.0/16 (Docker's usual default bridge) and 100.64.0.0/10 (Tailscale's addresses). This example uses 10.23.0.0/16 with the VLAN ID as the third octet.

Firewall to switch, switch to access point and switch to Proxmox are tagged trunks; OPNsense's documentation warns against mixing untagged VLANs into the firewall trunk. Other devices get untagged access ports.

On Proxmox, make the bridge VLAN-aware and put the host's management address on VLAN 10, as in the Proxmox VE network documentation. Each VM then gets its own VLAN tag:

auto vmbr0
iface vmbr0 inet manual
    bridge-ports eno1
    bridge-stp off
    bridge-fd 0
    bridge-vlan-aware yes
    bridge-vids 2-4094

auto vmbr0.10
iface vmbr0.10 inet static
    address 10.23.10.5/24
    gateway 10.23.10.1

Create one SSID per wireless VLAN: Trusted, IoT and Guest. Cisco Meraki recommends at most three per access point, because each SSID sends its own beacon every 100 ms at the lowest data rate.

Firewall rules between VLANs

OPNsense and pfSense evaluate rules on the interface where traffic enters, top to bottom: the first match wins, and anything unmatched hits the default deny. Both are stateful, so allowing Trusted to reach the proxy on 443 also lets the replies back.

For each VLAN, allow what it needs, block every private range with an alias named RFC1918, then allow the internet. On the IoT interface:

Rule 2 covers the firewall's public WAN address, which the alias misses; pfSense calls this destination This firewall (self). Narrow exceptions go above the blocks: Trusted to the proxy on 443, your admin laptop to the Proxmox web UI on 8006, Home Assistant to IoT. The alias is IPv4 only, so if your VLANs get IPv6 prefixes, block those too.

Casting is the usual surprise. AirPlay and Google Cast discover devices with multicast DNS on 224.0.0.251, which Apple notes is usually not routed across subnets. Run an mDNS repeater between Trusted and IoT, such as OPNsense's os-mdns-repeater plugin, and allow Trusted to reach the TV.

Services behind a reverse proxy

One reverse proxy, such as Caddy, Traefik or Nginx Proxy Manager, in the Servers VLAN terminates TLS and routes by host name, so the firewall allows 443 to one address only.

Use names under a domain you own, such as jellyfin.home.example.com. Avoid .local, which RFC 6762 reserves for multicast DNS; names under .internal or home.arpa work locally, but no public CA issues certificates for them.

Get certificates from Let's Encrypt with the DNS-01 challenge: your ACME client creates a TXT record at _acme-challenge.<name> through your DNS provider's API, so nothing has to be reachable from the internet. It is also the only challenge type that issues wildcards, and you want one. Let's Encrypt submits every certificate to public Certificate Transparency logs, so *.home.example.com publishes one name instead of your service list. Since Caddy 2.10, other sites reuse a matching wildcard certificate:

*.home.example.com {
	tls {
		dns cloudflare {env.CF_API_TOKEN}
	}
	abort
}

jellyfin.home.example.com {
	reverse_proxy 10.23.30.21:8096
}

This needs a Caddy build with the caddy-dns/cloudflare module and a token limited to Zone.Zone:Read and Zone.DNS:Edit. Certificates last 90 days today and 45 days by February 2028, so automate renewal.

Remote access options

WireGuard is a good default for yourself: per the WireGuard paper, it never answers unauthenticated packets, so scanners cannot see it. It still needs an inbound port, which carrier-grade NAT rules out; a WAN address in 100.64.0.0/10, the RFC 6598 shared range, is a telltale sign.

Tailscale and Cloudflare Tunnel connect outward instead. Tailscale's DERP relays only forward packets that stay WireGuard-encrypted, and a subnet router reaches the Servers VLAN without a client on every VM. A tunnel suits services shared with people who won't install a VPN; Cloudflare Access can add a login. The zero trust architecture diagram explains why identity beats network location.

DNS and DHCP per VLAN

The firewall serves DHCP on each VLAN, with reservations for servers. OPNsense enables Unbound, a validating, recursive resolver, by default. Run Pi-hole or AdGuard Home in the Servers VLAN for Trusted and IoT: both filter ads and trackers, hold the local records that point *.home.example.com at the proxy, and forward other queries to Unbound (how DNS works follows one lookup end to end). Guests use the firewall directly. Run a second filtering instance on another machine: if the only one stops, those VLANs lose name resolution.

Backups and power

Follow 3-2-1: three copies, two kinds of storage, one offsite. Your VMs are the first copy, nightly backups to the NAS or a Proxmox Backup Server the second, and an encrypted copy in a cloud bucket the third. Proxmox Backup Server makes incremental, deduplicated, encrypted backups that Proxmox calls safe even on targets you don't fully trust. RAID and snapshots are not backups. Export the firewall configuration (one XML file in OPNsense and pfSense), keep it with this diagram, and test restores; the disaster recovery architecture diagram covers RPO and RTO.

Put the firewall, switch, Proxmox host and NAS on a UPS. With Network UPS Tools (NUT), the machine connected to the UPS tells the others over the network to shut down, so the switch must be on the UPS too. Size it from the draw at the wall and the datasheet's runtime chart: you need minutes, not hours.

The home lab network diagram

How to read it:

• Top row: internet, firewall, switch. The WAN denies all inbound traffic except WireGuard on UDP 51820 (dashed).
• Trunks carry tagged VLANs: 10 to 50 to the switch, 10, 20, 40 and 50 to the access point over PoE, 10 and 30 to Proxmox.
• Frames are VLANs with ID, name and CIDR. Management, VLAN 10, is the label under the switch.
• Teal edges are allowed flows: HTTPS 443 from Trusted and VPN clients to the proxy, then HTTP to the apps. Dashed gray is the nightly backup.
• The access point maps the home, iot and guest SSIDs to VLANs 20, 40 and 50.
• The Markdown block holds the VLAN plan and settings; the legend explains link colors.

Drawing home lab network diagrams clearly

• Label every VLAN with its ID, name and CIDR on the frame itself.
• Mark trunks with the VLANs they carry. A VLAN missing from one trunk is the classic bug.
• Draw the firewall as the only path between VLANs, with allowed flows labeled by port.
• Show the way in from outside, even when it is one UDP port.
• Leave out containers, MAC addresses and switch port numbers. They belong on a physical diagram, as the network topology diagram guide explains.
• Keep it with your config backups and update it when a rule changes.

Build it in Archboard

1. Sign in with Google or GitHub and create a diagram.
2. From the Network pack, add Internet, a Firewall labeled OPNsense or pfSense and a Switch in a row, and a Wireless node for the access point below and to the right.
3. Add four Subnet frames for VLANs 20, 30, 40 and 50, each with its name and CIDR.
4. In Servers, add a Load Balancer as the reverse proxy (the pack has no proxy type), a Server for Proxmox and a Device with Kind set to NAS. Add a laptop Device in Trusted and an IoT Device in IoT.
5. Connect them, set each link's connection type to WAN, Ethernet, PoE or Wi-Fi, and label it with its VLANs or SSID. Draw allowed flows in teal, WireGuard and backups dashed.
6. Add a Legend from the Network pack, a Markdown block from the Core pack with the VLAN plan, and Core Text labels for each VLAN's rule.

If your apps live in a compose.yaml, the Docker Compose to diagram tool drafts the services side, and the network diagrams page shows the whole pack. The example uses 15 diagram nodes, within the Free plan, which is also the Free limit per diagram.

FAQ

What VLANs should a home lab have? Usually five: management, trusted, servers, IoT and guest. Add more only when devices need different rules; each VLAN adds rules and often an SSID.

Do I need a managed switch for VLANs? Yes, a managed or smart switch with 802.1Q support, plus an access point that maps SSIDs to VLANs. Unmanaged switches cannot put ports into VLANs.

Should I run OPNsense or pfSense as a VM on Proxmox? It saves a box, but every host reboot takes the house offline. A small dedicated firewall is easier to recover. If you virtualize, give the WAN its own NIC and keep a config export off the host.

Is it safe to open a port for a self-hosted service? It puts the app's login page on the internet, so its security updates become your defense. Prefer a VPN; if you must forward, send only 443 to the reverse proxy and add authentication in front.

Can I use Let's Encrypt for internal-only services? Yes, with DNS-01: a TXT record proves you control the domain, so the service never has to be reachable from the internet. A wildcard keeps service names out of Certificate Transparency logs.

Start free — one seat, no credit card.