The modern home office is no longer just a laptop and a printer. It houses smart TVs, robotic vacuums, Chinese IP cameras, personal smartphones, and workstations handling production client code, SSH keys, and staging database replicas.

Placing consumer IoT appliances on the same flat /24 subnet as your engineering workstation is a critical security vulnerability. Cheap smart plugs and IP cameras rarely receive firmware patches and are common entry points for automated botnets.

This guide details how to implement strict layer-2 and layer-3 network segmentation using IEEE 802.1Q VLANs on MikroTik RouterOS.

Network Architecture Overview

We construct three logically isolated broadcast domains on a single physical switch trunk:

VLAN IDNameSubnetSecurity Posture
VLAN 10TRUSTED_MGMT10.10.10.0/24Workstations, dev servers, NAS. Full internet & inter-VLAN access.
VLAN 20IOT_UNTRUSTED10.10.20.0/24Smart TVs, bulbs, cameras. Outbound internet only, blocked from LAN.
VLAN 30GUEST_PUBLIC10.10.30.0/24Client smartphones, visitors. Isolated client-to-client, rate-limited.

RouterOS Configuration Script

Connect via Winbox or SSH to your MikroTik router (RB5009, hEX, or CCR) and execute:

routeros
# 1. Create the hardware bridge
/interface bridge add name=bridge1 vlan-filtering=no

# 2. Add VLAN interfaces on top of the bridge
/interface vlan
add interface=bridge1 name=VLAN10_MGMT vlan-id=10
add interface=bridge1 name=VLAN20_IOT vlan-id=20
add interface=bridge1 name=VLAN30_GUEST vlan-id=30

# 3. Assign IP Subnets to each VLAN interface
/ip address
add address=10.10.10.1/24 interface=VLAN10_MGMT network=10.10.10.0
add address=10.10.20.1/24 interface=VLAN20_IOT network=10.10.20.0
add address=10.10.30.1/24 interface=VLAN30_GUEST network=10.10.30.0

# 4. Configure DHCP Pools and Servers
/ip pool
add name=pool_mgmt ranges=10.10.10.50-10.10.10.200
add name=pool_iot ranges=10.10.20.50-10.10.20.200
add name=pool_guest ranges=10.10.30.50-10.10.30.200

/ip dhcp-server
add address-pool=pool_mgmt interface=VLAN10_MGMT name=dhcp_mgmt disabled=no
add address-pool=pool_iot interface=VLAN20_IOT name=dhcp_iot disabled=no
add address-pool=pool_guest interface=VLAN30_GUEST name=dhcp_guest disabled=no

# 5. Define Bridge VLAN Tables (Trunk to ether2, Access on ether3-5)
/interface bridge vlan
add bridge=bridge1 tagged=bridge1,ether2 vlan-ids=10,20,30
add bridge=bridge1 untagged=ether3 vlan-ids=10
add bridge=bridge1 untagged=ether4 vlan-ids=20
add bridge=bridge1 untagged=ether5 vlan-ids=30

# 6. Enable Bridge VLAN Filtering
/interface bridge set bridge1 vlan-filtering=yes

The Zero-Trust Firewall Rulebook

Having separate subnets is useless if the router routes packets between them by default. You must configure stateful firewall filter rules:

routeros
/ip firewall filter
# Accept established, related, and untracked connections
add chain=forward action=accept connection-state=established,related,untracked comment="Accept Established"

# Drop invalid packets
add chain=forward action=drop connection-state=invalid comment="Drop Invalid"

# Allow Trusted Management (VLAN 10) to access everything
add chain=forward action=accept in-interface=VLAN10_MGMT comment="Allow MGMT to all"

# Allow all VLANs to access the Internet (out-interface=WAN)
add chain=forward action=accept in-interface-list=LAN out-interface=ether1_WAN comment="Allow Internet"

# Explicitly DROP IoT and Guest from reaching other local subnets
add chain=forward action=drop in-interface=VLAN20_IOT dst-address=10.10.0.0/16 comment="Block IoT from LAN"
add chain=forward action=drop in-interface=VLAN30_GUEST dst-address=10.10.0.0/16 comment="Block Guest from LAN"

With these rules active, compromised consumer IoT devices on VLAN 20 cannot initiate connections to your development machines or network shares on VLAN 10, eliminating lateral movement threats across your local infrastructure.