Best practices for creating Virtual Machines in different VLANs? reddit / selfhosted ---------------------------------------------------------------------- shanebagel1 · 2023-12-19 00:24 ​ [I have a new switch I want to setup a homelab with. I want to create 4 VLANs. Where would I deploy a web server to? Or it it recommended to have a separate VLAN for web server traffic?](https://preview.redd.it/ 9xoaks00b57c1.png?width=283&format=png&auto=webp&s=fa348f373c653c56b43 83fcc04d6a432da0a58bb) ---------------------------------------------------------------------- NoNameJustASymbol · 2023-12-19 01:58 A web server... that will be exposed to the Internet? If yes, isolate. ---------------------------------------------------------------------- seanpmassey · 2023-12-19 04:10 I think you need to be a bit more clear on your ask here. Most modern applications have some form of web server component. What will the web server be hosting? And will it be internal only or accessible from outside your network? ---------------------------------------------------------------------- VviFMCgY · 2023-12-19 04:16 I personally do have a dedicated Web VLAN, with strict firewall rules If someone compromises my reverse proxy VM, there is little they can actually get to ---------------------------------------------------------------------- PaulEngineer-89 · 2023-12-19 05:13 Why should your applications be able to see each other on the LAN? Shouldn’t each be its own VLAN? ---------------------------------------------------------------------- RydRychards · 2023-12-19 06:51 I have a vlan for my personal devices, one for IOT, one for productive services, one for homelabbing, one for guests and one for devices that don't need internet access. I have put them into three firewall zones and made it so that the safe zone can talk to all zones, the less safe zone can only access the internet and the productive services can talk to everything in the less safe safe zone. ---------------------------------------------------------------------- shanebagel1 · 2023-12-19 14:06 I would say accessible from outside. I also bought a firewall so this stuff could be accessible from WAN ---------------------------------------------------------------------- seanpmassey · 2023-12-19 15:41 OK. In that case, I agree with some of the other posters. You would want to create a dedicated VLAN for this. In networking terms, this would be a DMZ (or demilitarized zone). It's a dedicated network segment for services that face the internet and has firewall rules that limit what traffic can pass between the web server and the other internal networks. I'd recommend creating a new VLAN. But I would use a different IP range (like [172.16.0.0/24](https://172.16.0.1/24)) for this network segment. This has two benefits - first, it makes it easy to identify that this is your DMZ network and second - it makes it easier to configure firewall rules restricting traffic between the DMZ and internal networks. I would also set up firewall rules restricting traffic from [172.16.0.0/24](https://172.16.0.0/24) to [10.0.0.0/8](https://10.0.0.0/8) to only necessary services. If your web server gets hit, you're not exposing the rest of your home or internal network. ---------------------------------------------------------------------- NoNameJustASymbol · 2023-12-19 19:33 My setup... * vlan10-dmz * vlan11-guest * vlan99-vpn * vlan110-iot * vlan111-users * vlan112-servers * vlan254-mgmt Should be self explanatory. My public web server is in vlan10-dmz, isolated, as it should be. There is another internal only web server in vlan112-servers. Vlan254-mgmt is firewall, switch, access points, wireless LAN controller (for access points), and the main device for my equipment. Wireless guests have a separate SSID to connect to and those connections are put in vlan11-guest. They only get Internet. The only piece that may not be so obvious is my VPN server has one interface in the DMZ and one in vlan99-vpn. VPN users get put in vlan99-vpn. LOL, I just noticed somebody downvoted my previous response about putting a public web server in the DMZ.