Multi-VLAN Network Segmentation & Dual-WAN Failover
A segmented home/lab network built to enterprise conventions — VLAN-isolated trust tiers with stateful inter-VLAN firewall rules, automated ISP failover, and DNS-level ad/threat filtering — rather than one flat trusted subnet.
Project Brief
- Role
- Network architecture and implementation owner
- Scope
- A segmented home/lab network with 4 VLAN tiers, dual-WAN failover, and headless diagnostic tooling against the platform's own management API
- Timeline
- Built and iterated in 2026
- Result
- A network where a compromised or misbehaving IoT device can't reach anything else on the network, internet connectivity survives a primary-ISP outage automatically, and every configuration change is auditable after the fact
Evidence Included
Directional isolation, not a blanket block
Inter-VLAN firewall rules are written to allow legitimate control traffic in one direction while denying lateral movement in the other — verified by testing both directions, not assumed from the rule set alone.
Multi-target failover health checks
WAN failover is driven by multiple independent ICMP and DNS probe targets rather than a single check, avoiding false failovers from one unreliable probe target.
Auditable configuration history
Every VLAN, firewall, and firmware change is logged with a timestamp via a custom audit script, making post-change troubleshooting and change review straightforward.
4 (trusted/lab/IoT/unfiltered)
VLAN tiers
2 (fiber primary + cellular failover)
WAN paths
Multi-target ICMP + DNS
Failover health checks
The Problem
A single flat network puts every device — trusted workstations, IoT devices of unknown provenance, and lab/test equipment — on equal footing: any compromised or misbehaving device can reach anything else on the network. There was also a single upstream internet connection, so any ISP outage took every service offline with no failover path.
My Approach
Multi-Tier VLAN Segmentation
- Designed a 4-tier VLAN architecture separating trusted general-purpose devices, a lab/test tier for experimentation, IoT devices, and an explicitly unfiltered tier for devices that need unrestricted internet access without exposure to the rest of the network.
- Wrote stateful inter-VLAN firewall rules that default-deny IoT-to-private-network traffic — an IoT device can reach the internet, but not other VLANs — while still allowing traffic in the direction actually needed for control (e.g., a phone on the trusted VLAN reaching an IoT device).
- Locked down the gateway's own administrative interfaces (SSH, HTTP management) to be unreachable from any VLAN except the trusted management tier, closing off the router itself as a lateral-movement target.
- Enabled 802.11r fast BSS transition on the wireless tier so trusted-network clients roam between access points without a re-authentication delay, and layered DNS-over-HTTPS at the gateway so DNS queries aren't visible or spoofable in plaintext on the wire.
Automated Dual-WAN Failover
- Configured a secondary, independent internet uplink (a cellular backup connection) alongside the primary fiber connection, with policy-based dual-WAN routing on the gateway.
- Set up multi-target health monitoring (ICMP and DNS probes against multiple independent targets, not a single point of failure in the health check itself) so the gateway detects a real primary-WAN outage and fails over automatically, rather than relying on a single, possibly-unreliable probe target.
Headless Diagnostic & Audit Tooling
- Built a small, dependency-light Python toolset that talks directly to the network controller's REST API for live diagnostics: real-time port/PoE telemetry, switch-port-to-device mapping, and wireless RF utilization scans, without needing the web dashboard open.
- Added an automated post-change audit log so every configuration change (VLAN edits, firewall rule changes, firmware updates) leaves a timestamped record, making it possible to reconstruct what changed and when after the fact.
Key Engineering Challenges Solved
Getting isolation direction right
A naive "block everything between VLANs" rule also blocks the legitimate control traffic a user actually needs (e.g., reaching a smart device from a phone). Solved by writing directional, stateful rules — deny lateral IoT-initiated traffic, but allow trusted-initiated traffic into the IoT tier for control — rather than a blanket bidirectional block.
Failover health-check reliability
A single health-check target can itself go down without the primary WAN actually being down, causing a false failover. Solved with multiple independent monitoring targets across both ICMP and DNS, so a real outage requires multiple correlated signals, not one flaky probe.
Stack
Networking Hardware
Segmentation & Routing
Wireless & DNS
Tooling
Skills Demonstrated
- ▸Network segmentation and zero-trust-adjacent design at a home/lab scale using the same directional-isolation principles as enterprise networks
- ▸Failover architecture with multi-target health-check design to avoid false-positive failovers
- ▸Headless automation against a vendor's REST API when the web dashboard isn't sufficient for repeatable diagnostics
- ▸Change-auditing discipline applied even in a low-stakes environment, as good practice rather than a compliance requirement