🌐

Split your home network

Your smart plug doesn't need to see your laptop. Boundaries are healthy.

A cheap smart plug has no business seeing your laptop. VLANs split one physical network into several separate ones. You'll build it in Packet Tracer first, then see how to do the same at home.

IntermediateA weekendVLANs

🧰 What you need

Cisco Packet Tracer (see the virtual network lab)
For the real thing later: a managed switch or a router that supports VLANs

Let's build it

Build the picture

One 2911 router, one 2960 switch, two PCs. PC0 → switch Fa0/1 (home), PC1 → switch Fa0/2 (guest), switch Gig0/1 → router Gig0/0.

Create the VLANs on the switch

enable
configure terminal
vlan 10
 name HOME
vlan 20
 name GUEST
interface fa0/1
 switchport mode access
 switchport access vlan 10
interface fa0/2
 switchport mode access
 switchport access vlan 20
interface g0/1
 switchport mode trunk
end

Give each VLAN a gateway on the router

One cable, two networks: "router on a stick".

enable
configure terminal
interface g0/0
 no shutdown
interface g0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
interface g0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0
end

Address the PCs

PC0: 192.168.10.10, gateway 192.168.10.1. PC1: 192.168.20.10, gateway 192.168.20.1. Both masks 255.255.255.0. Ping PC0 from PC1: it works, because the router happily routes between them. That's the next thing to fix.

Keep guests out of home

configure terminal
access-list 120 deny ip 192.168.20.0 0.0.0.255 192.168.10.0 0.0.0.255
access-list 120 permit ip any any
interface g0/0.20
 ip access-group 120 in
end

Doing it at home

The easiest version is already in your router: turn on Guest Wi-Fi and put smart gadgets on it. For the full version, a small managed switch (around $30) plus a router or firewall that supports VLANs (OPNsense, pfSense, or many prosumer routers) lets you do exactly what you just built.

✅ How you know it worked

PC1 (guest) can still reach its own gateway 192.168.20.1, but pinging PC0 (home) fails.

💥 Break it on purpose

On the switch, move Fa0/2 into VLAN 10 (switchport access vlan 10) without changing PC1's address. PC1 can't reach anything, not even a gateway. Its address says one network while the switch put it in another. Mismatched VLANs are a classic real-world fault.

🧠 What's really going on

The switch tags every frame with its VLAN number and keeps the VLANs completely separate, as if they were different switches. The trunk carries all VLANs over one cable, still tagged, to the router, which has a sub-interface acting as the gateway for each. Traffic between VLANs has to pass through the router, and that's exactly where the access list decides what's allowed.

← Back to all network labs · Stuck? Email me