Design intent
Servers should not share the same trust assumptions as personal devices, guest systems, cameras, or experimental workloads. Each segment exists for a reason and communicates only where policy allows it.
AMS - LabpfSense and VLAN segmentation
A policy-driven network design that separates servers, trusted clients, lab workloads, management systems, and less-trusted devices.
Overview
Segmentation turns one flat network into a set of intentional security zones. pfSense handles routing, policy, NAT, and VPN connectivity while VLANs keep different classes of systems in the right lanes.
pfSenseVLANsNATVPNFirewall rules
Troubleshooting approach
Changes are validated from both sides of the path: addressing, tagging, routing, firewall policy, name resolution, and packet flow. That makes failures explainable instead of mysterious.
Next improvements
I am continuing to improve rule documentation, logging, remote-access controls, and monitoring so changes remain safe as the environment expands.
More systems. More questions.
Explore every project ↗