Current state: no VLANs. Everything — nodes, services, cameras, personal devices, IoT — shares 192.168.86.0/24.
| VLAN | Purpose | Members today |
|---|---|---|
| 10 mgmt | Proxmox, switches | nodes .100–.102, .13 |
| 20 services | LXC/VM services | .200–.216, .2, .6 |
| 30 cameras/IoT | no internet, no lateral | cameras .30/.31, future IoT |
| 40 trusted clients | personal devices | .231 etc. |
Prereqs: managed switch + router VLAN support (or an OPNsense box), then move vmbr0 to VLAN-aware bridging. Cameras are the strongest candidates to isolate first — they currently sit on the same L2 as everything else with vendor firmware.