From one network to several trust zones
The original network was convenient because everything could see everything. It was also difficult to reason about. I used pfSense and VLAN-aware switching to separate servers, trusted administration, everyday clients, IoT devices, and guest access according to what each group actually needed to reach.
Start with trust, not numbers
VLAN IDs and subnets come later. Begin by deciding which systems share a security context and which communication paths are truly required.
Rules should describe intent
A rule that works but cannot be explained is future technical debt. Names, comments, logs, and diagrams should make the policy understandable during the next incident.
Verify the whole path
When connectivity fails, check tagging, addressing, gateways, routes, firewall state, DNS, and the return path. Packet captures replace guesswork with evidence.
The return path taught the hardest lesson
A device can have the correct address and still fail because tagging, gateway selection, state, DNS, or the route back is wrong. Working through those failures made packet captures and firewall logs part of the normal process. Segmentation became less about creating VLANs and more about proving every allowed and denied path.
Designing access as a conversation
For every zone, I try to describe the intended conversation in plain language before writing a rule. An administration workstation may manage servers, a monitoring service may collect metrics, and an IoT device may reach only DNS, time, and a small set of internet destinations. Anything outside that description begins as denied.
This approach makes troubleshooting more deliberate. I can follow a connection from the source interface through its VLAN tag, address, gateway, firewall state, destination, and return route. If the traffic fails, each checkpoint provides evidence. If it succeeds unexpectedly, the same path shows which rule or alias is too broad.
Segmentation is never truly finished because services and trust relationships change. The maintainable part is the review process: use descriptive aliases, log important boundaries, remove temporary exceptions, and revisit whether a permitted path is still necessary. The result is not merely more networks. It is an environment where access has a reason and that reason can be audited.