Time for a networking lesson then…
First, a VLAN is called a “virtual lan” because it’s not physical. Think of getting a router and plugging the WAN port (internet side) into 1 switch and the LAN side into another switch. That makes 2 LANs (technically a WAN and a LAN, but ignore that, think that there’s no internet and you’re just connecting two switches that in turn connect to nothing else for now).
Now you’ve got yourself 2 collision domains (layer 2) - the WAN switch and the LAN switch, segregated by the router. One side will have a subnet (layer 3) and the other will have another subnet.
Now if you want to grow your network and you know your router is plenty capable, then you don’t have much choice than those 2 subnets / LANs. So VLANs come into play.
Imagine you have a switch with 48 ports. There’s so many ports on it, but you don’t want all the devices to go into a single subnet. So you get a router capable of setting vlans on the LAN NIC (and that assumes the switch is already vlan capable). What VLANs do is that it separates / segments a swtich into multiple switches, basically creating a virtual switch. You have 48 ports on the switch, but you want 3 different subnets? No problem. Set the router connection to the switch into what is called “trunk port” and set however many ports on the switch to “access ports.”
What a trunk port is, well, it’s an interface that doesn’t spit just normal layer 2 switch packets, but tags the packets, depending from which vlan they come. You need your router to understand tagging (vlans) to get trunk port functionality.
This saves you from having to buy a NIC with multiple interfaces. For example, if you build a router PC, assuming you’re familiar with building PCs… then you’d be buying a PCI-E NIC with 4 ports and each port would be a different subnet / (physical) LAN. So you’d connect those 4 ports into the 48 port switch, to 4 different ports, all the ports in different VLANs (with the ports in “access port” mode), so you’d be limited by 4 VLANs only.
With a router that knows VLANs, you can get 4096(+ depending on the standard, not getting into that). So instead of needing 4000 ports on your router, you can do 4000 VLANs with just 1 port.
Now to your build / network. If you’re planning to have 3 switches for each room, but you don’t want all of your devices in the same subnets in each room, then you’d need managed switches (i.e. vlan capable switches) for each room. There’s some cheap options that come with a GUI, to allow you to easily set up VLANs. My zyxel xgs1210-12 might be a bit overkill for each room (since you don’t have 10G SFP connection to each room), so maybe 3x netgear GS308E-400NAS switches might do (they’re literally $30 each). It seems to work for me, I had 1 for a while.
You’d need a router better than what your ISP is offering you though. Everyone likes to throw opnsense of pfsense around. I’m not a fan (yes, I’m highly biased against them, so take it for what it’s worth and you decide for yourself). For hardware, it doesn’t need to be much, just ideally that it has 2 ports (or it can have 1 port and use a USB ethernet port, but be very careful, in most of everyone’s experience, the USB ethernet ports will die after a while of constant usage, so we all kinda recommend PCI-E hardware, even in m.2 form factor if you can’t get a full-blown PC as a router).
Actually, my recommendation for a router would be something low power consuming (like single board computers), which requires some setup. If you’re very familiar with linux, then something like a nanopi r4s would be a great fit. The problem is… there’s no GUI. I think it might have gotten an OpenWRT port (the hardware is plenty capable), so maybe you’d be able to set VLANs in the Interfaces tab in luci web gui, idk. If you want to support the OpenWRT project, there’s OpenWRT One router (which is a rebranded / collaboration with Banana Pi).
If you really want something with more oomph, you can go wild with an odroid h4+ and do a forbidden-router (I’m also against forbidden routers, but I have the h4 base model, it’s solid), or you could do the h4 base with an m.2 NIC and use emmc for the OS (assuming the OS will allow you to install to emmc, some don’t and idk if pfsense / opnsense allow it - it goes without saying: plain linux, freebsd and openbsd will allow you). Or there’s other solutions, like the protectli fw4b, which some forum members have and like it.
So, the way this would work, you’d need the router in your internet room / closet, connect that to a 5-8 port managed switch, then connect each room’s rj45 cable ends to the switch. Then you connect each switch in every room (you might want to set them up on a workbench and configure them locally, before you go live with them, because you might need to factory reset them a couple of times, before you get it right, since setting vlans will cut off the management subnet.
Then, once you trunking from the router to the “main switch” and from the main switch to the 3 switches in the other rooms, you can start configuring ports in access mode in each VLAN you want, then plug your devices into them. I personally prefer this kinda setup:
- management network (basically only your most trusted system, along with the switches, routers and hypervisors)
- trusted clients (most of your other computers, which would include the wifi AP for residents)
- untrusted clients w/ internet (a vlan for things like IoT devices that won’t work without internet - I don’t have any of those, but if you have an alexa or some crap-lights or nest or something, that’s where you should put them - this might be a good place for an xbox that doesn’t receive updates anymore, but that still needs internet access for some odd reason)
- untrusted clients w/o internet (I like this for security cameras, but you can put other IoT in here)
- guest network (completely firewalled off from the other networks, although it goes without saying that untrusted vlans shouldn’t be able to connect to other vlans either, just to the internet or not even there - this 1 is just like untrusted clients w/ internet, but it’s for actual guests)
- partly trusted devices (here I’d put my windows VMs that would still need to connect to my NAS, but I’d only allow firewall ports for just NFS or Samba and nothing else - if I had jellyfin, nextcloud or other stuff, I’d probably allow them to that too)
- optional server vlan (if you want everything “server” that you trust in a separate vlan than management, since the management vlan has green light in the firewall to access everything, while technically services that you trust don’t really need to access other areas of your network, just to be accessed - it does make operational stuff easier, since you’d e.g. allow FROM partly_trusted_clients to → servers:{443,445,2049,53,853} to the whole subnet and not have to worry about poking these firewall rules from partly trusted clients to your management vlan, since you’re doing it to a separate services vlan)
So that’s about 7 vlans. You can go wilder if you want and split things even more. Don’t want Alexa to know you have a Google Nest? Separate VLANs for them. You kinda trust your security cameras, but you want them offline, but you don’t trust your vacuum to be in the same dark vlan as your cameras? Separate dark vlans for your cameras and your vacuum. There’s endless (?) possibilities (until you run out of ports, then you add more switches, connect them in trunk port and your network is now a rats-nest of wires and switches over switches).
To be honest i just assumed that the defaults for most/all routes is significantly more limited than openWRT, as I’ve never used anything beyond the ISP provided devices.