VLAN Setup from Scratch: OPNsense + Proxmox + Switch (Complete Guide)

Note: This post is sponsored by Scrimba. Scrimba offers interactive coding courses that let you learn by writing and editing code directly in the browser. Get 20% off Scrimba Pro (Click Here)

What's up, guys! Welcome or welcome back to the blog. In our last video, we explored Proxmox networking and briefly touched on VLANs, but this time we’re going deep. In this blog post, I'm going to walk you through a full end-to-end VLAN setup—starting from the firewall, moving through the switch, and finishing off in Proxmox. This is part of the bigger home lab project we’re building piece by piece, so if you want to follow along, this is a great place to jump in.

What Is a VLAN?

Let’s start with a quick recap. A VLAN, or Virtual Local Area Network, is a way to logically segment your network. It allows you to divide a single physical interface into multiple virtual networks. This is super helpful for improving security, organizing traffic, and avoiding unnecessary hardware.

Each VLAN can have its own DHCP, DNS, subnet, and firewall rules. That separation lets you control traffic between VLANs and isolate services. In a home lab, this is essential—especially if you have public-facing apps or services like Usenet indexers. You can isolate them so if they ever get compromised, they don’t affect the rest of your environment.

Planning Your VLAN Layout

Before configuring anything, you need a solid plan. Figure out what VLANs you need, what their purpose is, and how your IP layout will look. You’ll need to assign:

• A unique VLAN ID
• A name
• A subnet

For this setup, I’m creating:

• VLAN 30 (DMZ): For public-facing services. Subnet: `10.10.30.0/24`
• VLAN 20 (APPS): For internal apps like Nextcloud, Home Assistant, etc. Subnet: `10.10.20.0/24`

Planning ahead makes everything easier once you start configuring your firewall, switch, and Proxmox.

What Equipment Do You Need?

You’re going to need three main things:

1. Firewall – This is where your VLANs are created and managed. I’m using OPNsense installed on a ZimaBoard.
2. Managed Switch – Must support 802.1Q tagging (VLAN tagging). This is how VLAN traffic is recognized. I use a Cisco SG220, but any managed switch with 802.1Q will work.
3. Device to Generate Tagged Traffic – In this case, that’s Proxmox. The VMs on Proxmox will send VLAN-tagged traffic to the switch, which forwards it to the firewall.

Now that we understand what we need, let’s configure everything step by step.

Step 1: Configure VLANs on OPNsense

Start by creating VLAN interfaces:

• Go to Interfaces > Other Types > VLAN
• Click the + icon
• Choose your parent interface (usually LAN)
• Enter the VLAN tag (e.g., 20 for APPS)
• Set the priority (I usually leave this as Best Effort)
• Add a description

Once created, assign the VLAN interface under Interfaces > Assignments and enable it. Set a static IP address for the interface. For example, VLAN 20 could use 10.10.20.1/24.

Step 2: Enable DHCP for VLAN Interfaces

Go to Services > DHCPv4 and select your VLAN interface.

• Enable DHCP
• Define a range (e.g., `10.10.20.50` to `10.10.20.253`)
• Add your gateway (e.g., `10.10.20.1`)
• Optionally add DNS servers, domain names, and search lists

Unbound DNS (under Services > Unbound DNS > General) is enabled by default on all interfaces, so you should be good to go unless you want to limit DNS to specific VLANs.

Step 3: Set Firewall Rules

By default, OPNsense blocks all traffic on new interfaces. To allow basic connectivity:

• Go to Firewall > Rules > VLAN Interface
• Create a new rule:
  - Action: Pass
  - Interface: VLAN 20 (or whatever you’re working on)
  - Source: VLAN 20 net
  - Destination: any

This allows full outbound traffic for testing. You can later add block rules to prevent inter-VLAN communication for better isolation.

Step 4: Configure the Switch

In your managed switch (in my case, Cisco):

• Go to VLAN Management
• Add VLAN 20 and VLAN 30 with matching IDs

Then, tag the ports:

• Tag the port where Proxmox connects (e.g., port 23) with VLANs 20 and 30
• Tag the port going to the firewall (e.g., port 25) with VLANs 20 and 30

Some switches require one untagged VLAN, so I created VLAN 1000 as a "black hole" for any untagged traffic.

Step 5: Proxmox VLAN Setup

In Proxmox:

• Go to Datacenter > Node > Network
• Edit the bridge (e.g., vmbr1) and make sure VLAN Aware is enabled

Then tag each VM:

• Go to VM > Hardware > Network Device
• Set VLAN Tag to 20 or 30 depending on which VLAN you want that VM on

Once this is done, your VMs should receive an IP from the correct VLAN's DHCP server.

Test it:

• SSH or console into the VM
• Run ip a and confirm it has a VLAN-specific IP
• Run ping google.com to check internet access

If everything is set up right, you’re good to go!

Optional: Block Inter-VLAN Traffic
Go to Firewall > Rules > VLAN 30 and add a block rule:

• Action: Block
• Source: VLAN 30 net
• Destination: VLAN 20 net

Move the block rule above your pass-all rule, or disable "Quick" on the pass rule so it doesn’t override the block. This ensures VLAN 30 can’t talk to VLAN 20.

Final Thoughts

At this point, everything should be working. Your Proxmox VMs are sending tagged traffic to the switch, the switch knows what to do with that traffic, and the firewall applies rules and routing.

This is a powerful setup that gives you total control over how your lab or home network behaves. Whether you're exposing services, isolating workloads, or just learning, VLANs make it possible to create a network that feels truly segmented.

Thanks for tagging along. If you're building your own lab or just exploring VLANs, let me know how it's going in the comments. Don’t forget subscribe, and—as always—stay geeking. Peace!