VLANs for Proxmox + OPNsense: My Homelab Setup

If your homelab is still running on one flat network, everything is simple — until it is not. In this video, I show how VLANs help split a homelab into cleaner network zones for private devices, production services, public-facing systems, and experiments. We look at how VLANs work across the managed switch, OPNsense firewall rules, and Proxmox VLAN-aware bridges, so you can decide how to segment your own network without adding a separate switch or firewall interface for every zone.

If your homelab is still running on one flat network, VLANs are one of the cleanest ways to separate private devices, servers, public services, and test environments without adding a separate physical switch for every network.

This is a short companion write-up for the video with the basic VLAN model, the OPNsense setup, and the Proxmox parts I changed in my own homelab.

Network zones

In my setup I use three main VLANs:

VLAN	Subnet	Purpose
10	10.10.0.0/16	Private LAN
20	10.20.0.0/16	Production / Homelab
30	10.30.0.0/16	DMZ / public-facing services

You do not need to use the same IDs or subnets. The important part is that each VLAN has a clear purpose and its own subnet.

Switch setup

On the managed switch, create the VLAN IDs first and then decide which ports should carry them.

Typical port types:

• Untagged / access port: for normal devices that should only be in one VLAN.
• Tagged / trunk port: for devices that need to carry multiple VLANs over one cable, like OPNsense or Proxmox.

In my case, the ports to Proxmox and OPNsense are trunk ports because they need access to multiple VLANs.

OPNsense setup

In OPNsense, create VLAN interfaces on the physical interface connected to the switch.

Example:

VLAN 10 → 10.10.0.1/16
VLAN 20 → 10.20.0.1/16
VLAN 30 → 10.30.0.1/16

After that:

1. Assign the VLAN interfaces.
2. Enable and configure each interface.
3. Configure DHCP for the VLANs that need it.
4. Add firewall rules for each VLAN.

The VLANs create the separation, but the firewall rules decide what is actually allowed to communicate between them.

Proxmox setup

For Proxmox, the main change is making the Linux bridge VLAN-aware.

Example bridge option:

bridge-vlan-aware yes

After that, VMs and containers can be assigned to a specific VLAN by setting the VLAN tag on their network interface.

That makes the setup much more flexible because a VM does not have to live in the same network as the Proxmox host itself.

Common mistakes

• Creating a VLAN on the firewall, but forgetting it on the switch.
• Tagging the wrong switch port.
• Putting a VM in one VLAN but giving it an IP from another subnet.
• Forgetting that DHCP is configured per VLAN.
• Leaving broad allow rules that make segmentation pointless.
• Changing the switch management VLAN without a fallback connection.

If something does not work, follow the path step by step:

VM → Proxmox bridge → switch trunk → OPNsense VLAN interface → firewall rule