Many small offices still run a single flat network: office PCs, the server, printers, CCTV cameras and guest WiFi all share the same subnet. It works until one infected laptop or a cheap IoT device gives an attacker a path to everything else. Network segmentation with VLANs is one of the most effective and affordable fixes. Here is the checklist we use when designing small office networks.
1. Why segment at all?
On a flat network, every device can talk to every other device. That means a compromised camera or a visitor's phone on WiFi can reach your accounting PCs and file server. VLANs split one physical network into several logical networks, so you decide exactly which groups of devices may communicate.
2. Start with a simple VLAN plan
A typical small office plan looks like this:
| VLAN | Purpose |
|---|---|
| 10 | Office PCs and laptops |
| 20 | Servers |
| 30 | Printers and VoIP phones |
| 40 | CCTV cameras and NVR |
| 50 | Guest WiFi |
| 99 | Network management (switches, APs, firewall) |
Keep it simple. Five or six VLANs cover most offices; more VLANs mean more rules to maintain.
3. Default deny between VLANs
Segmentation only helps if traffic between VLANs is filtered. Route inter-VLAN traffic through a firewall and start from "deny all", then allow only what is needed:
- Office PCs → servers: only the ports your applications use
- Guest WiFi → internet only, no access to internal VLANs
- CCTV VLAN → no general internet access; allow only what the NVR and viewing app require
- Management VLAN → reachable only from admin workstations
4. Configure switch ports correctly
- Access ports (untagged) for end devices — one VLAN per port
- Trunk ports (tagged) only between switches, the firewall and access points
- Don't carry user data on the native VLAN, and disable unused ports
5. Map WiFi networks to VLANs
Create separate SSIDs for staff and guests and map each to its own VLAN. Enable client isolation on the guest network so visitors can't see each other's devices.
6. Isolate CCTV properly
Cameras and IoT devices are frequent weak points. Keep cameras and the NVR on their own VLAN and avoid port-forwarding the NVR to the internet. For remote viewing, use a VPN or the vendor's official app instead.
7. Document everything
Label every cable and port, keep an IP and VLAN plan, and store a simple network diagram. Good documentation turns a two-hour troubleshooting session into a five-minute fix.
Common mistakes
- Creating VLANs but allowing "any to any" between them
- Leaving the management interfaces of switches and APs on the user VLAN
- Mixing guest WiFi with the office network "temporarily"
- No documentation, so nobody knows which port belongs to which VLAN
Wrapping up
VLAN segmentation doesn't require enterprise budgets a managed switch, a proper firewall and a clear plan are enough to make a small office network much safer.
This guide was written by the team at KGB Vision Group, a licensed security and IT company in Serbia. We design and install network infrastructure for offices and warehouses and configure Fortinet firewalls and VPN for companies. Questions? Contact us.
Top comments (0)