I built my home lab the way I'd build a small production network: real switches, a real router, real VLAN segmentation — not a flat /24 with everything trusted.

The layout

  • Two Arista switches, LACP port-channel trunk between them for redundancy and bandwidth
  • VyOS router VM handling inter-VLAN routing, NAT, and firewall policy
  • Separate VLANs for lab hosts, servers, storage, and out-of-band IPMI management
  • DHCP relay (ip helper-address) from switch SVIs back to a central Kea DHCP server

Why segmentation first

Management interfaces don't belong next to workloads. IPMI/BMC interfaces live on their own VLAN with no route to anything that doesn't need them — the same principle that separates a defensible network from a flat one. When I later added an isolated pentest segment, the pattern was already there: new VLAN, explicit firewall ruleset, default deny toward everything else.

What broke and what it taught me

The interesting parts were the failures. A backup route advertised over a VPN overlay blackholed the entire LAN because a peer accepted a route to its own subnet — every host was healthy, and nothing could talk. Diagnosing that meant reading policy routing tables, not pinging harder. Lesson: a route you didn't mean to advertise is an outage you didn't plan for.

DHCP relay across VLANs is another one people get wrong: directly-attached segments need the DHCP server listening explicitly, relayed segments don't — mixing those two models silently serves no leases.

Verification over vibes

Every change gets proven: LACP state checked on both ends, firewall rules tested by actually generating the traffic they should block, failover exercised by pulling the primary path. If it isn't tested, it's a guess.