VLAN Segmentation for Small Offices: A Practical Checklist

Kgb Work — Tue, 06 Oct 2026 10:58:40 +0000

Many small offices still run a single flat network: office PCs, the server, printers, CCTV cameras and guest WiFi all share the same subnet. It works until one infected laptop or a cheap IoT device gives an attacker a path to everything else. Network segmentation with VLANs is one of the most effective and affordable fixes. Here is the checklist we use when designing small office networks.

1. Why segment at all?

On a flat network, every device can talk to every other device. That means a compromised camera or a visitor's phone on WiFi can reach your accounting PCs and file server. VLANs split one physical network into several logical networks, so you decide exactly which groups of devices may communicate.

2. Start with a simple VLAN plan

A typical small office plan looks like this:

VLAN	Purpose
10	Office PCs and laptops
20	Servers
30	Printers and VoIP phones
40	CCTV cameras and NVR
50	Guest WiFi
99	Network management (switches, APs, firewall)

Keep it simple. Five or six VLANs cover most offices; more VLANs mean more rules to maintain.

3. Default deny between VLANs

Segmentation only helps if traffic between VLANs is filtered. Route inter-VLAN traffic through a firewall and start from "deny all", then allow only what is needed:

Office PCs → servers: only the ports your applications use
Guest WiFi → internet only, no access to internal VLANs
CCTV VLAN → no general internet access; allow only what the NVR and viewing app require
Management VLAN → reachable only from admin workstations

4. Configure switch ports correctly

Access ports (untagged) for end devices — one VLAN per port
Trunk ports (tagged) only between switches, the firewall and access points
Don't carry user data on the native VLAN, and disable unused ports

5. Map WiFi networks to VLANs

Create separate SSIDs for staff and guests and map each to its own VLAN. Enable client isolation on the guest network so visitors can't see each other's devices.

6. Isolate CCTV properly

Cameras and IoT devices are frequent weak points. Keep cameras and the NVR on their own VLAN and avoid port-forwarding the NVR to the internet. For remote viewing, use a VPN or the vendor's official app instead.

7. Document everything

Label every cable and port, keep an IP and VLAN plan, and store a simple network diagram. Good documentation turns a two-hour troubleshooting session into a five-minute fix.

Common mistakes

Creating VLANs but allowing "any to any" between them
Leaving the management interfaces of switches and APs on the user VLAN
Mixing guest WiFi with the office network "temporarily"
No documentation, so nobody knows which port belongs to which VLAN

Wrapping up

VLAN segmentation doesn't require enterprise budgets a managed switch, a proper firewall and a clear plan are enough to make a small office network much safer.

This guide was written by the team at KGB Vision Group, a licensed security and IT company in Serbia. We design and install network infrastructure for offices and warehouses and configure Fortinet firewalls and VPN for companies. Questions? Contact us.

DEV Community: Kgb Work