A home network can grow from a router and a few laptops into a mix of cameras, lab servers, and services that guests should never see. Before creating another VLAN, list which devices need to talk and what they need to reach.

Start with one example

A camera might need to send video to a recorder and receive time updates. An administration laptop might need to reach the recorder’s web interface. Those are separate connections. Write down the source, destination, and port for each one before creating a rule.

A VLAN separates devices at the link layer. When traffic needs to cross VLANs, routing and firewall rules determine which connections are allowed. After a change, test both a connection you expect to work and one you expect to be blocked.

Keep a known working path to the router while changing its management network. Then label the ports and save the rule list somewhere you can reach when the lab is offline.