VLAN (Virtual LAN)

A VLAN (Virtual Local Area Network) is a logically separate network created on top of shared physical switching hardware. It lets you split one switch — or many interconnected switches — into multiple isolated broadcast domains, so devices on different VLANs cannot reach each other at Layer 2 even though they share the same cabling. The standard behind it is IEEE 802.1Q, which inserts a 4-byte tag into the Ethernet frame header identifying which VLAN each frame belongs to. For anyone running miners, nodes, and family devices on one home network, VLANs are the single most cost-effective isolation tool available.

Tags, access ports, and trunks

The 802.1Q tag carries a 12-bit VLAN ID (VID) plus priority bits, and it sits in the frame immediately after the source and destination MAC addresses. Switch ports take one of two roles. An access port belongs to a single VLAN and exchanges ordinary untagged frames with the end device, which never knows VLANs exist. A trunk port carries traffic for many VLANs at once across a single link — between switches, or up to a router or firewall — using the tag to keep every VLAN's frames distinct. This is how segmentation scales across a building without pulling separate cable plants per segment: one physical topology, many logical networks. Each VLAN is typically mapped to its own subnet, and anything crossing between VLANs must pass through a Layer 3 device — which is precisely where you enforce policy.

Why miners belong on their own VLAN

Mining hardware is the textbook candidate for segmentation. An ASIC's web UI and management services were never designed to face hostile networks, stock firmware ships with well-known default credentials, and a machine that hashes for years often runs software that is equally old. Placing miners on a dedicated VLAN — alongside similarly untrusted IoT gear — means a compromised camera cannot browse to your miners, and a compromised miner cannot reach your workstations, your node, or your backups. The same logic protects the other direction: your miners' management plane stops being visible to every laptop, phone, and guest device in the house. Combined with a firewall ruling on inter-VLAN traffic, you can permit exactly what is needed — your management host reaching the miners' dashboards, the miners reaching their pool — and deny everything else by default.

Practical design for a home lab

A sane small-rack layout needs only a handful of segments: trusted workstations on one VLAN; miners and IoT on another; servers and nodes on a third; anything deliberately internet-facing in a perimeter segment — a proper DMZ; and optionally a guest VLAN with internet-only access. The hardware bar is low — managed switches with 802.1Q support are commodity items, and open-source router/firewall distributions handle the inter-VLAN routing and rules on modest machines. The classic pitfalls are equally well-known: leaving every port on the default VLAN 1 (configure it deliberately or retire it), forgetting that a trunk carries whatever VLANs it is allowed to (prune them), and assuming VLANs are cryptographic security (they are Layer 2 isolation — real, but enforced by switch configuration, not by mathematics).

Segmentation as a sovereignty practice

VLANs operationalize two principles that recur throughout this glossary: shrinking the attack surface each device exposes to the others, and layering controls so no single failure is fatal — defense in depth applied to your own wiring closet. A sovereign operator's network should look like their custody setup: compartmentalized, deliberate, and built so that one compromised component tells the attacker as little as possible about the rest.

Start small: two VLANs — trusted devices and everything-else — capture most of the benefit in an afternoon, and the design can grow segment by segment as the rack does.