Current state: no VLANs. Everything — nodes, services, cameras, personal devices, IoT — shares 192.168.86.0/24.
| VLAN | Purpose | Members today |
|---|---|---|
| 10 mgmt | Proxmox, switches | nodes .101–.103 |
| 20 services | LXC/VM services | .200–.224, .2, .6, .150 |
| 30 cameras/IoT | no internet, no lateral | cameras .90–.93, smart plugs .86–.89 (+ Dad's house .30.10-.12), future IoT |
| 40 trusted clients | personal devices | DHCP clients .25–.75 |
Prereqs: managed switch + router VLAN support (or an OPNsense box), then move vmbr0 to VLAN-aware bridging. Cameras are the strongest candidates to isolate first — they currently sit on the same L2 as everything else with vendor firmware.