- A flat network means one compromised device is a straight shot to everything — VLANs separate management, services, and IoT
- Port-forwarding to Proxmox or SSH is an open invitation to automated scanners worldwide
- Tailscale (WireGuard under the hood) gives full remote access without opening a single port on your router
Friday night, a hotel room in Kyoto, spotty wifi. I open Tailscale on my phone, type in Proxmox's address, and I'm into my cluster like I never left home. No open ports on my router, no VPN subscription, no waiting around.
It wasn't always this easy. For months, my homelab ran on a flat network — the NAS, the VMs, and the living room's smart plug all sitting on the same segment. One compromised device away from everything. Here's how I fixed that.
The problem with a flat network
On a default consumer router, everything lives on the same subnet — typically 192.168.1.0/24. Proxmox's web interface, your Jellyfin server, that $20 IP camera from who-knows-where, and the wifi you hand out to guests: they can all talk to each other freely.
This isn't a theoretical problem. A poorly secured camera or smart plug sitting on the same network as your cluster is a direct route into Proxmox's admin interface — exactly the kind of device nobody updates and everybody forgets about. Segmenting the network isn't enterprise paranoia transplanted into your living room. It's the bare minimum once you're hosting something that actually matters.
Segmenting with VLANs
A VLAN (Virtual LAN) creates logically isolated networks on the same physical infrastructure — no need for separate cabling or switches per zone. I run three:
- VLAN 10 — Management: Proxmox interface, switch, access points. Nothing else touches it.
- VLAN 20 — Services: every VM and LXC container hosting an application (Jellyfin, the *arr stack, and so on)
- VLAN 30 — IoT / Guests: connected gadgets and guest wifi, cut off from everything else by default
On the network side, my UniFi gateway handles VLAN creation and the firewall rules between them: in the UniFi Network app, under Settings → Networks, you create one network per VLAN with its own ID, then add a rule explicitly blocking VLAN 30 from reaching VLANs 10 and 20. Without that rule, creating VLANs accomplishes nothing — logical segmentation without a firewall between zones is just an illusion of security.
On the Proxmox side, you need a VLAN-aware bridge so the host can carry multiple VLANs over a single physical interface:
auto vmbr0
iface vmbr0 inet static
address 192.168.10.5/24
gateway 192.168.10.1
bridge-ports eno1
bridge-stp off
bridge-fd 0
bridge-vlan-aware yes
bridge-vids 2-4094
Then, for each VM or container, you just set the VLAN Tag field on its network device (Hardware tab → Network Device). A VM tagged 20 lands directly on the Services network without ever touching Management. That one field does all the heavy lifting.
The real headache: getting in from outside
Once the network is segmented, the question that took me longest to solve properly was: how do I get to any of this when I'm not home?
The blunt approach — forwarding a port to Proxmox or SSH — works, but it's a bad idea. An open port on a public IP gets scanned constantly by bots all over the world. It stops being a question of "if" and becomes a question of "when" someone finds an unpatched hole. I checked the logs once after opening port 22 out of curiosity: connection attempts every couple of minutes, from IPs all over the globe, within the first hour.
The other usual option, a general-purpose commercial VPN, adds a subscription and an extra network hop for a use case it isn't really built for — those services are designed to mask your IP for streaming, not to selectively expose an entire home network.
Tailscale: the thing that changed how I work
Tailscale builds a mesh VPN on top of WireGuard. Every device — phone, laptop, homelab VM — gets a fixed IP on a virtual private network and talks directly to the others via NAT traversal. The concrete result: no port to open on your router, the connection just negotiates itself.
To expose an entire VLAN instead of a single machine, I installed a lightweight LXC container on Proxmox acting as a subnet router:
curl -fsSL https://tailscale.com/install.sh | sh
echo 'net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf
sudo tailscale up --advertise-routes=192.168.10.0/24,192.168.20.0/24 --accept-dns=false
One step stays manual, deliberately: in the Tailscale admin console, you have to approve those advertised routes before they go live. That stops a compromised device from silently declaring itself a gateway into your network without review.
Going further, ACLs (access rules) let you tightly control who can reach what. Here's a simple example that lets my personal devices reach Proxmox and SSH on the Management VLAN, and the whole Services VLAN with no port restrictions:
{
"tagOwners": {
"tag:homelab": ["autogroup:admin"]
},
"acls": [
{
"action": "accept",
"src": ["autogroup:member"],
"dst": ["192.168.10.0/24:22,8006", "192.168.20.0/24:*"]
}
]
}
On your phone or laptop, install the Tailscale app, sign in, flip the toggle. The free personal tier is plenty for this — as of writing, it comfortably covers the device count of a personal homelab.
The result
No open ports left on my UniFi Dream Machine — an external scan of my router doesn't turn up anything exploitable anymore. Proxmox's connection logs went quiet: no more attempts from random IPs, only my own devices, identified through Tailscale. And in practical terms, I ran the cluster from a hotel in Kyoto without noticeable lag or last-minute fumbling.
VLAN segmentation has a nice side effect too: if a device on the IoT VLAN ever gets compromised, it technically can't reach anything beyond itself and the internet. Not an absolute guarantee, but a real reduction in attack surface for one afternoon of configuration.
The rest of this series
- Which hypervisor to choose?
- Network and remote access without opening a port — you're here
- Jellyfin or Plex: picking the first service — coming up
- Monitoring with Netdata & Uptime Kuma — coming up
What you can do this weekend
Three concrete steps, in order: create a separate Management VLAN on your router and move your hypervisor's admin interface onto it. Install Tailscale on a small VM or LXC and test remote access before you actually need it in an emergency. And if you've got a stray port-forward pointing at SSH or Proxmox, close it now — you won't need it anymore.