The VLANs I have, and why they stopped meaning anything

Most home network posts are greenfield. Someone lays out a clean set of VLANs, assigns them tidy subnets, and presents the finished diagram. It's useful if you're starting from nothing, and almost nobody is starting from nothing.

I have three or four VLANs already. That's the part people assume is the hard bit, and it isn't. The hard bit is that I added them one at a time, each for a perfectly good reason at the moment I added it, and nothing has ever gone back to ask whether the boundaries still describe anything.

How it decays

Nobody decides to let their segmentation rot. It happens one reasonable decision at a time.

A device needs to go somewhere. The segment it should live in is inconvenient: wrong switch, wrong SSID, wrong subnet for the thing it needs to talk to. So it goes on the primary VLAN, just for now, and now becomes eighteen months.

Something in the lab segment needs to reach a service on the trusted one. That's a firewall rule. It's a narrow rule, it's justified, and it's fine. Then there's another, and one that's slightly broader because the first two were annoying to maintain separately.

Six or seven repetitions of that and you have a network where the VLANs still exist, the rules still work, and the segmentation no longer does anything. It's a diagram, not a control. The boundaries are drawn but they don't hold, and worse, I can no longer tell you from memory which side of them any given device is on.

That's the actual failure. Not that it's insecure in some specific demonstrable way. It's that I've lost the ability to reason about it.

The forcing function

The primary VLAN is running out of address space.

I'm genuinely pleased about this. "I should tidy up my network sometime" is a task that survives indefinitely on a list, because there's no date attached and no consequence for deferring it. Address exhaustion isn't like that. You can't add another firewall rule to make more addresses appear. It converts a vague intention into work with a deadline, which is the only reliable way I've ever got this kind of thing done.

It's also diagnostic. The primary VLAN running out is itself the evidence that too much ended up there. If segmentation had held, the pressure would be distributed.

What I'm doing differently

Start from trust boundaries, not the device list. The question I asked last time was "where does this printer go," device by device, which is how you end up with assignments driven by convenience. The right question is: what categories of thing exist here, what should each be allowed to reach, and what's the blast radius when one is compromised. Devices get sorted into that afterwards. The categories come first and they're the durable part.

Size for five years, not five months. The current primary VLAN was sized for what was on it at the time. Every device since has been an argument with that decision. Subnets are free; renumbering is not.

Write down what each segment is for. In words, somewhere I'll find it again. Most of the decay came from not having a stated rule to test a new device against. With no definition, "does this belong here?" has no answer, and the default answer becomes yes.

The part that actually worries me

The plan is the easy half. This is a live network that a household depends on: Home Assistant, printers, the lab, everyone's phones, consoles and laptops. Re-addressing it means moving all of that without a maintenance window and without a sympathetic audience.

Some of it will move cleanly. Some of it will not: anything with a hardcoded address, anything that discovered a peer once and cached it, and every automation that quietly depends on something being reachable that briefly won't be.

That's the entry I'm actually looking forward to writing, and it's the one that won't be a tidy diagram. The project is in my backlog. How soon I get to it depends on how fast I run out of address space.