The Problem: One Network Means One Breach

A compromised smart thermostat on your main network has direct access to your file server. That is not theory — it is how ransomware spreads from a $30 IoT device to your entire business in minutes. Flat networks eliminate boundaries. An attacker who gains a foothold anywhere moves everywhere. Segmentation creates those boundaries.

Minimum Viable Segments

Three segments cover most small and medium businesses. Do not overcomplicate this.

• Primary business network: Workstations, servers, domain controllers, managed printers. This segment holds your data and your credentials.
• Guest WiFi: Visitors, employee personal phones, contractor laptops. Internet access only. Zero access to business resources.
• IoT / building systems: Smart TVs, HVAC controllers, security cameras, badge readers, unmanaged printers. Internet access for updates. No access to business or guest segments.

Each segment lives on its own VLAN. VLAN IDs are arbitrary — 10 for business, 20 for guest, 30 for IoT — but pick a scheme and stick to it.

Hardware That Actually Works

Consumer switches do not support VLANs. Consumer routers (including most ISP-provided boxes) cannot tag VLANs or enforce inter-VLAN firewall rules. If you are running a business on a Netgear Nighthawk, you are not segmented — you are exposed.

Business-grade options that work:

• Ubiquiti UniFi: Switches, access points, and a Cloud Key or Dream Machine Pro for routing. Manageable via web UI. Good price-to-capability ratio.
• pfSense / OPNsense: Open-source firewall appliances. Run on a Netgate box or repurposed hardware. Steep learning curve, total control.
• Cisco Meraki: Enterprise licensing model. Expensive but centralised management and solid support.

Access points must support multiple SSIDs mapped to different VLANs. UniFi APs do this natively. The guest SSID tags traffic to VLAN 20 all the way back to the firewall. The business SSID tags to VLAN 10. If your APs cannot do this, replace them.

Guest WiFi on Consumer Gear: Better Than Nothing

If you cannot replace the router today, enable the guest network feature on your current WiFi router. Most modern units isolate guest clients from the main LAN at the radio level. It is not true VLAN segmentation — a determined attacker with physical access or a compromised AP firmware can bypass it — but it stops casual snooping and drive-by infections. Treat it as a temporary mitigation, not a solution.

Printers Are High-Risk IoT Devices

Printers run outdated Linux kernels, exposed management interfaces, and rarely patched firmware. They are IoT devices with network privileges. Put them on a dedicated VLAN (or the IoT VLAN) with a strict firewall rule: workstations can initiate connections to the printer VLAN on port 9100 (raw printing) or 631 (IPP). The printer VLAN cannot initiate connections to the business VLAN. Block outbound internet from printers unless you have a specific firmware update mechanism that requires it.

Firewall Rules: Default Deny

Every inter-VLAN rule starts with deny. You then punch holes only for documented requirements:

• Business VLAN → File server VLAN (SMB, RPC, LDAP)
• Business VLAN → Printer VLAN (ports 9100, 631, 515)
• Business VLAN → Internet (HTTP, HTTPS, DNS, VPN)
• Guest VLAN → Internet only
• IoT VLAN → Internet only (NTP, vendor update endpoints)

No rule allows IoT → Business. No rule allows Guest → Business. No rule allows IoT → Guest. If a vendor demands broader access, push back or isolate that device on its own VLAN with a dedicated allow list.

Testing: Prove It Works

Do not assume your rules are correct. Test from each segment:

1. Connect a laptop to the guest SSID. Ping the file server IP. Ping a workstation IP. Ping the gateway of the business VLAN. All should fail.
2. Connect to the IoT VLAN (plug into a tagged switch port). Attempt SSH to a workstation. Attempt SMB to the file server. All should fail.
3. From a business workstation, print to the printer VLAN. Verify the job completes. Then try to ping the printer's management interface from the guest VLAN. It should fail.

If any cross-segment traffic succeeds that you did not explicitly allow, your firewall rules are wrong. Fix them before you declare the project done.

Documentation: The Part Everyone Skips

Draw the topology. Label every switch port with its VLAN assignment. List every VLAN ID, subnet, gateway IP, and DHCP scope. Write every firewall rule in a table: source segment, destination segment, protocol, port, action, business justification. Store this in your IT documentation system — not on a sticky note, not in your head.

Six months from now, a printer will stop working. A new AP will join the network. An auditor will ask for your segmentation evidence. You will open this document and fix the problem in minutes. Without it, you will spend days tracing cables and guessing at rules.

Common Failure Modes

• Management VLAN left open: The switch management interface sits on VLAN 1, accessible from the business VLAN. Move it to a dedicated management VLAN restricted to your admin workstation.
• DHCP relay misconfiguration: Guest devices get business VLAN IPs because the helper address points to the wrong scope. Verify each VLAN serves its own subnet.
• mDNS / Bonjour bleeding across VLANs: Some APs and switches forward multicast by default. Disable unless you have a reflector configured for specific services.
• VPN users landing on the business VLAN without posture check: Remote access should drop users into a quarantine VLAN until device health passes.

Start This Week

You do not need a perfect design. You need a working separation between business, guest, and IoT. Buy a managed switch (UniFi 24-port PoE is $300). Buy a firewall appliance (Netgate 2100 is $400). Configure three VLANs. Write five firewall rules. Test them. Document them. That afternoon, your attack surface shrinks by 80 percent. The rest is refinement.