What does a router VLAN mean? The TV box was scanning my NAS, and I spent 60 yuan to build a firewall for the home network

was discovered last month. Every so often, I check Synology's log center to check login records—this habit was picked up when I reinforced my NAS security back then. That day, I found more than a dozen consecutive failed connections. The source IP was 192.168.31.152, port 5000, mostly from 2 to 4 a.m. Who is 31.152? Checking the router device list, it was the TV box in the living room, a generic item priced at 89 yuan on Taobao, with firmware unupdated for three years.

Why did it scan my NAS's management port in the middle of the night? I don't know, maybe something messy was stuffed into the firmware. But I felt a chill down my spine: with over forty devices at home, cameras, speakers, vacuum cleaners, boxes—these 'not very secure' devices, and NAS with family photos—sleeping on the same network segment, anyone caught could easily reach the door of my NAS. That night, I decided to build a network wall at home and partition it.

wall-building is a regular army tactic called VLAN. After three days of reviewing materials and struggling with it myself, I figured out the whole thing.

to put VLANs in plain terms: building walls inside switches, your IPTV port is used every day

VLAN which sounds mysterious but actually boils down to one sentence: split one switch into several units for .

ordinary switches are like a big open office, where the devices plugged in recognize each other and can call out to whom. The VLAN is built in this large open room, forming three small compartments—people inside the compartments can talk to each other, but no matter how shouting is done between compartments, no one hears them; each person can only go through the door (the upper link) to leave.

You might think this is far from you, but in reality, your family uses it every day. The IPTV port on the optical modem is actually the VLAN-built by the operator: TV and internet services are squeezed into the same fiber and entered into the community, distinguished by VLAN tags—IPTV uses one VLAN, broadband uses another, two logically independent channels that don't interfere with each other. When I writing about single-line multiplexing for IPTV, I mentioned copying VLAN numbers. Many people copy numbers like 45 and 51, but don't realize they're actually copying this 'compartment number.'

VLAN is just a number, from 1 to 4094. The numbers themselves have no meaning; whichever the bureau gives you is the one you get. If you want to divide your home by yourself, it's customary to use integers like 10, 20, or 30 as the district name, which is easy to remember.

five isolation methods, I went through them from free to paid queues

and only when I got the hang of them did I realize that "separating devices" in home networks has more than one path: cheap ones are free, expensive ones only cost a few dozen yuan. I've listed all five types I can find. The key is to distinguish what each and what not to block

This table was summarized from my own pitfalls. At first, I just wanted to find a "one-click isolation," but I found there was none at all— every method was just to block a wall, and trying to surround all four sides would have to be .

my family's current three zones: people are people, equipment is equipment, guests are guests

The plan for coming down to the ground looks like this, point by point.

the twenty or so wireless smart devices rushed to the visitor network. my main router is AX3000T, I've done this before—guest network is set to isolation by default, but tests can't connect to the NAS or access the router's backend , so I can only go online. This "no internal network access" feature is perfect for installing smart devices: speakers, robot vacuums, thermometers, and so on. They only need to access the manufacturer's cloud and don't need to touch my NAS. The vacuum cleaner only recognizes the pitfall of 2.4G. I've encountered it before, and I also set the guest network to 2.4G—killing two birds with one stone.

six POE cameras and wired devices mounted underneath, passing through a managed switch. this is a new one I bought for 60 yuan, a Mercury SG105M Pro, five gigabit of a gigabit. The method is "port isolation": go to its management page, set the port connecting to the POE switch as an isolation port, so the cameras can't see each other and no one can sense each other's traffic. The wiring sequence is: main router LAN port → SG105M's port 1 (uplink), POE switch → SG105M's port 2 (isolation port). The entire process takes five minutes, with no equipment or configuration required.

NAS. Computers and phones remain on the mainnet 31.x. recording service proceeds as usual: the camera exits through the uplink port, goes to the main router, and then to the NAS. This channel is connected—this is also the boundary of port isolation. It blocks lateral contact between cameras, but cannot block access to the NAS. If you want the camera to "only push streams and not touch the management port," which home devices can't do, the layer relies on NAS to reinforce the bottom line: change the management port to a high position and enable two-step verification. I've written about these before, so I won't repeat them.

as for casting from phones and computers to the TV or accessing the NAS, all are within the mainnet and unaffected.

only learned three costs after building the wall

Once the wall is finished, trouble follows—three of which are quite practical.

First, mDNS can't get past the wall, so the first to cast suffers. I made a mistake: I casually stuffed the smart speaker into the visitor network as well. That night, the phone's screen casting couldn't find the speaker—the phone was on the main network, the speaker was in the guest area, and the mDNS detection mechanism for casting was broadcast packets. broadcast was inherently not cross-subsidiary , so the two zones refused to respond. The solution is either to move the device you need to cast back to the same area as your phone, or to install an OpenWrt mDNS reflector for forwarding—the latter is already beyond the scope of "home use." I chose the former: move the speaker back to the mainnet, since it's not considered a high-risk device anyway.

Second, foolproof switches do not recognize VLAN labels. my original plan was to use the eight-port foolproof switch in the living room to zone it out, but after checking, I found out that ordinary switches receive data packets with VLAN labels, either pretend they didn't see them and forward them or simply throw them away—behavior is uncontrollable. If you want to switch to VLANs, every switch on the link must be a managed , and replacing them all costs one or two hundred yuan. I gave up and only did port isolation on the newly bought unit, which was sufficient.

Third, Xiaomi's official firmware doesn't even include VLAN. I searched through the AX3000T backend, and apart from the dedicated IPTV VLAN settings, there was no universal VLAN division feature. If you want to play real VLAN at home, either use a main router to OpenWrt (AX3000T there are mature tutorials, I'll save them for later when I want to tinker), or use a soft router. This is determined by the official firmware positioning; the home market is not intended for you to touch this layer.

no one needs to bother with it

I'm writing so much not to urge everyone to build walls. A neighbor came to my house and saw this set. When they got home, they were halfway done, but the camera almost cut off, so they had to take it down again. Honestly, most people don't need to:

with a clear order at the end. Following this method would be less likely to go wrong: First, count the devices at home and group the "must-access" (phone, TV, speakers, NAS) into one area; then drive smart devices that only go online and never touch the internal network to the guest network; For those with POE cameras, 60 yuan is used for managed switches for port isolation; After completing each one, verify everything — whether the casting can be found, whether the camera recording is normal, and whether the visitor area devices can turn on the NAS (which should be unavailable). One day you feel it's not enough, and then consider flashing OpenWrt to play real VLAN, that will be another trap.