Building a secure pfSense home lab with VLANs and VPN
A pfSense router turns a spare mini PC, appliance, or virtual machine into a capable edge firewall for a home lab. With VLAN segmentation and encrypted remote access, one device can separate workstations, servers, smart-home equipment, guests, and management traffic while providing detailed visibility into network behaviour.
This design is useful in an Australian home connected through the NBN, whether the service terminates on FTTP, FTTC, HFC, or another access technology. The ISP hand-off may use DHCP or PPPoE, and some providers place customers behind carrier-grade NAT, which affects inbound VPN access.
The lab should be built in stages. Start with a reliable WAN connection and a simple LAN, then introduce tagged networks, firewall policy, DNS services, and VPN access one layer at a time. That approach makes faults easier to isolate and avoids locking yourself out of the firewall.
Choose the hardware and topology
A practical pfSense appliance needs at least two network interfaces: one for the WAN and one for the internal trunk. Four or more Intel-based ports are useful when you want a dedicated management interface, an isolated lab network, or a separate physical connection for testing. Small fanless systems are widely available through Australian computer retailers and marketplaces, while used business mini PCs can reduce the cost.
The basic topology is NBN equipment or an ISP modem in bridge mode, followed by pfSense, then a managed switch and wireless access point. The switch carries tagged VLANs to the access point, while wired devices connect to access ports assigned to the appropriate network. Use a UPS if the lab supports important services, since short power interruptions are common enough to justify protecting networking equipment.
Install pfSense and configure the WAN
Download the pfSense Community Edition installer from the official source and write it to a USB drive. During installation, assign the physical interfaces carefully. Connect the WAN interface to the NBN connection or bridge-mode modem, and connect the LAN interface to a laptop or managed switch for initial setup.
In the web interface, configure the Australian ISP requirements. Many NBN services use DHCP, while some providers require PPPoE credentials. Check whether the service uses IPv6 and whether the connection is behind CGNAT. A public IPv4 address is normally required for direct inbound VPN connections; if it is unavailable, use an IPv6 design, a hosted VPN endpoint, or a provider offering a public address.
Create a VLAN addressing scheme
Create VLANs under Interfaces and assign them to the physical interface connected to the managed switch. A clear scheme might use VLAN 10 for management, VLAN 20 for trusted clients, VLAN 30 for servers, VLAN 40 for IoT devices, VLAN 50 for guests, and VLAN 60 for VPN users. Use separate private subnets, such as 10.10.10.0/24, 10.10.20.0/24, and 10.10.40.0/24.
Give each VLAN an interface address and enable DHCP only where it is needed. Management should have a small, controlled address pool, while guest and IoT networks can use larger ranges. Configure the switch uplink as a tagged trunk and place ordinary device ports into untagged access VLANs. On the wireless access point, map separate SSIDs to the trusted, IoT, and guest VLANs.
Apply firewall policy between networks
pfSense blocks traffic between interfaces by default, so create rules deliberately rather than allowing every internal network to communicate. Trusted clients may need access to DNS, HTTPS administration, file servers, and selected lab services. IoT devices usually need outbound DNS, NTP, and internet access, but should be denied access to management interfaces and server subnets.
Place restrictive rules above broad allow rules. For example, permit the management VLAN to reach switch, access point, and pfSense administration addresses, then block those destinations from all other VLANs. Guest traffic can be limited to the internet, with RFC1918 destinations blocked. Enable logging temporarily while testing, then review blocked flows before deciding whether a narrower exception is required.
Add secure remote VPN access
WireGuard provides a lightweight option for remote administration and access to home services. Create a tunnel, generate a key pair for each client, and assign the tunnel an address range separate from the LAN VLANs. Add a WAN firewall rule for the chosen UDP port and a corresponding pfSense tunnel configuration. Each client should have only the permitted internal routes rather than unrestricted access by default.
OpenVPN remains useful where client compatibility or existing operational knowledge matters. Avoid exposing the pfSense web interface directly to the internet; remote administration should pass through the VPN and be protected with strong credentials and multi-factor authentication where available. If CGNAT prevents inbound connections, a site-to-site overlay or outbound tunnel to a public cloud host can provide a path back to the lab.
Test, monitor, and document the lab
Test each VLAN from a device connected to its assigned SSID or switch port. Confirm DHCP, DNS resolution, internet access, and the expected blocked paths. Use Diagnostics tools such as ping, traceroute, packet capture, and state inspection to distinguish routing problems from firewall policy errors. A temporary test laptop is safer than changing the configuration from your main workstation.
Review logs, interface statistics, DHCP leases, and VPN handshakes regularly. Back up the pfSense configuration after every stable change and store an encrypted copy away from the firewall. Australian homes often have a mix of smart TVs, cameras, assistants, and streaming devices, so inventorying their traffic helps identify equipment that should remain in the IoT segment.
Select an appliance for your budget
The right platform depends on throughput, noise tolerance, power usage, and how many services will run on the device. A modest appliance is sufficient for a typical NBN connection, while VPN encryption, IDS/IPS packages, multiple gigabit links, and virtualisation increase the CPU and memory requirements.
| Platform | Suitable use | Advantages | Limitations |
|---|---|---|---|
| Used business mini PC with two NICs | Entry-level lab and NBN routing | Low cost, easy to source in Sydney or Melbourne | May need a USB or add-on network adapter |
| Fanless multi-port appliance | Permanent home gateway | Quiet, low power, several Intel NICs | Higher purchase price and less upgrade flexibility |
| Small desktop with four NICs | Advanced VLAN and VPN lab | Strong CPU, expansion room, good throughput | Larger, noisier, and less power efficient |
| Virtual pfSense instance | Homelab experimentation | Snapshots, flexible resource allocation, easy testing | Depends on the hypervisor and host availability |
Operate the router responsibly
Keep pfSense, packages, switch firmware, and wireless access point software current. Subscribe to vendor security notifications and remove unused packages and accounts. If the lab stores personal information, camera footage, or work data, apply sensible retention and access controls consistent with Australia’s Privacy Act obligations and any requirements imposed by an employer.
A segmented network is a control, not a guarantee. Use unique passwords, disable unused switch ports, restrict administrative access, and keep a tested restore path. With clear VLAN boundaries, a carefully scoped VPN, and regular monitoring, a home lab can support cloud practice, systems administration experiments, and realistic hybrid infrastructure without exposing every device to the same network.