A network segmentation layout that holds up

Flat networks are the default because they work. Everything reaches everything, nothing needs configuring, nobody files a ticket. That holds right up until a compromised thermostat can reach the accounting workstation, or a guest on the lobby Wi-Fi can browse the file share.

The overcorrection is worse. Someone reads a hardening guide, builds fourteen VLANs, writes no rules between them, and now every troubleshooting session starts with "which VLAN is that on?" and ends with a permissive any-any rule that quietly undoes the whole exercise.

Here's the layout we deploy on most small business sites. Five networks. Each one exists for a reason you can say out loud. The vendor doesn't matter; this works the same on Fortinet, Ubiquiti, Meraki, or a pfSense box.

The five

Management

Switches, access points, the gateway, UPS network cards, PDUs. Nothing else. No workstations, no printers.

This is the network you use to fix the network, so it should be the least likely thing affected by whatever broke. Access restricted to a named set of admin machines or a VPN. If someone gets onto your management segment they own the infrastructure, including the controls you'd use to stop them.

Corporate

Employee laptops and desktops, file servers, the domain controller if you have one, network printers.

This is the network doing actual work. It gets internet and it gets internal resources. It has no business reaching the management segment, and nothing else has any business reaching it.

Guest

Visitor Wi-Fi, internet only.

Two settings make this real: client isolation on, so guests can't see each other, and no route to any internal subnet. A guest network that can reach the corporate network is a second front door with a friendlier name.

Rate limiting is worth setting here too, so one person's cloud backup doesn't eat the circuit.

Everything with bad firmware

Thermostats, TVs, smart plugs, badge controllers, and the espresso machine that inexplicably wants Wi-Fi.

Assume every device here is compromised and design as though it already is. Internet access if it genuinely needs it, nothing internal, and rules that let established sessions come back but don't let this side start a conversation.

This is where most small business breaches actually begin, and it's the segment that most often gets skipped.

Cameras and physical security

Cameras, recorder, door controllers.

Cameras are IoT devices with a worse security history and a higher consequence if breached. They also generate constant traffic you'd rather keep off the network everyone else uses.

Cameras talk to the recorder. The recorder is reachable from a small set of trusted machines. In most deployments the cameras themselves need no internet access at all. Block it and watch nothing break.

VLANs alone do nothing

This is the part people miss. Putting devices in separate VLANs without firewall rules between them just means the router does the forwarding instead of the switch. Traffic still flows.

The policy that makes it real:

1. Default deny between segments. Start from nothing allowed, then add.
2. Allow established and related return traffic, or nothing works and you'll be tempted to give up.
3. Write exceptions explicitly and narrowly. Corporate to cameras on the recorder port. Corporate to management from admin machines only. Each one with a comment saying why it exists.
4. Block everything from reaching management except that one admin path.

The comment field matters more than it looks. In two years, a rule with no explanation is a rule nobody dares remove, and permissive rules accumulate.

Two worth adding

A voice segment if you run desk phones. Less for security than for prioritisation and simpler troubleshooting. Voice traffic is small, constant, and unforgiving about jitter.

A personal-device network for employee phones, separate from both guest and corporate. People will connect their phones to something. Better that it's a network you designed.

What we skip

A VLAN per department. Sales and Marketing have identical security needs and identical access requirements. You've doubled your rule count and gained nothing. Segment by trust level and device type, not by org chart.

Segmentation nobody documented. Every segment gets an ID, a subnet, a purpose, and its rules written into the handover pack. A scheme nobody can explain is one bad afternoon away from becoming a flat network again.

Getting there from flat

You don't have to do this in one night.

1. Stand up management first and move infrastructure onto it. Lowest risk, immediate benefit.
2. Add guest. It's isolated by design and touches nothing existing.
3. Move the bad-firmware devices across in batches. This takes longest, because half of them need re-onboarding and some will fight you.
4. Cameras, usually alongside a camera refresh anyway.
5. Tighten corporate last, once everything else has moved off it.

Each step is independently useful and independently reversible, which matters more than elegance. The failure mode of a big-bang cutover is a Monday morning where nothing prints.

---

Segmentation isn't about how many VLANs you have. It's about being able to answer "if this device were compromised, what could it reach?" with something other than "everything."

Want to know what your current layout would allow? We do assessments, and they include a written map of what can actually talk to what.

• VLANs
• Security
• Design