Designing a Segmented Home Network with Sophos XG
The goals, trust boundaries, and design principles behind a segmented Sophos XG homelab.
A flat home network is convenient until it is not. Computers, televisions, smart-home devices, access points, cameras, storage, and virtualization hosts all share the same broadcast domain and usually the same level of trust. A compromised IoT device can then reach systems that deserve much stronger protection.
My goal was not to build an enterprise network at home. It was to introduce a few understandable trust boundaries and let Sophos XG decide which boundaries traffic may cross.
Start with communication needs, not VLAN numbers
The first inventory contained several different device classes:
- workstations and notebooks;
- infrastructure such as managed switches and access points;
- Proxmox and other virtualization hosts;
- servers, NAS storage, and central services;
- televisions and other media devices;
- IoT and smart-home equipment;
- HomeMatic, MQTT, and Zigbee2MQTT components;
- temporary systems used for experiments.
These groups do not need identical access. A notebook may need the internet, DNS, a NAS, and selected administration interfaces. A sensor normally needs DNS, NTP, and an MQTT broker—but not the management page of a hypervisor. An administrator may need to reach everything while an ordinary media device should reach almost nothing inside the network.
That gives the real design question:
Which initiator may use which service on which destination?
A VLAN plan is only a way to express the answer.
Give the firewall the routing role
I wanted Sophos XG to be the default gateway for the segmented networks. Each VLAN would therefore have a VLAN interface on the firewall, and the address of that interface would be the default gateway for clients in the corresponding subnet.
This has an important consequence: traffic between VLANs reaches Sophos XG and can be controlled by firewall rules. If a Layer-3 switch routed the same traffic directly, the firewall could not enforce those boundaries unless the design deliberately sent it through the firewall.
The managed switch still has an essential role. It transports tagged VLAN traffic over an 802.1Q trunk and assigns edge ports to the correct VLAN. It does not, in this design, make the security decisions.
Separate networks by trust and function
The initial model used logical groups such as:
| Network | Typical systems | Default posture |
|---|---|---|
| Management | Firewall, switches, access points, hypervisors | Highly restricted |
| Core services | DNS, MQTT, automation services, selected servers | Reachable only as required |
| Office | Trusted computers | Broad outbound, selective internal access |
| IoT | Appliances and embedded devices | Internet and explicit services only |
| Home automation | Controllers, sensors, gateways | Explicit broker/controller flows |
| Media | TVs and streaming devices | Internet plus selected discovery/services |
| Playground | Temporary test systems | Isolated and disposable |
The names matter more than the exact VLAN IDs. IDs are implementation details; trust boundaries are the architecture.
Design for safe administration
Changing VLANs remotely can disconnect the administrator from the firewall. I therefore wanted a management path that did not depend on the trunk being correct. A dedicated physical interface on Sophos XG became the safety net, while another interface carried the VLAN trunk to the switch.
This provides two benefits:
- A tagging mistake on the trunk does not necessarily remove access to WebAdmin.
- Administrative access can be confined to a small, intentional network.
Sophos Firewall distinguishes normal forwarded traffic from access to services on the firewall itself. Firewall rules control traffic that passes through the firewall; the local service ACL controls services such as the web administration console and SSH. Both need attention.
Prefer explicit flows
The tempting first rule is LAN -> LAN: Allow any. It makes testing easy, but it also recreates a flat network at Layer 3. A better starting point is to document required flows, for example:
- Office to NAS over SMB;
- administration workstation to hypervisor over HTTPS and SSH;
- Home automation to MQTT broker over the configured MQTT port;
- clients to DNS and NTP;
- IoT to internet, without access to management;
- monitoring server to infrastructure over explicitly selected protocols.
Some protocols, especially discovery protocols based on broadcast or multicast, do not naturally cross routed boundaries. That is not a reason to remove segmentation. It is a signal to decide whether a reflector, proxy, relay, or a different placement is justified.
The first architecture
The starting architecture was deliberately simple:
- Sophos XG terminates the WAN connection.
- One physical port remains available for direct administration.
- Another physical port connects to the managed switch as an 802.1Q trunk.
- Sophos VLAN interfaces are the gateways for the VLAN subnets.
- Access ports on the switch place untagged end devices in one VLAN.
- Firewall rules permit only documented communication between networks.
This architecture became the foundation for the rest of the series. The next step was to turn the trust model into a VLAN and IP-address plan without creating overlapping networks.