Network Segmentation for Small Businesses: VLANs, Guest and OT

On a flat network, every device can talk to every other device. The receptionist's PC can reach the hypervisor management page, the guest Wi-Fi can reach the file server, and the HVAC controller can reach the domain controller. Ransomware loves flat networks because one foothold is a foothold everywhere.

Segmentation splits the network into zones and puts a firewall between them. It sounds like an enterprise project. For a small company it is a few VLANs, a handful of rules and an afternoon of planning.

The zones most businesses need

Do not start with a diagram of twenty VLANs. Start with the question: if this zone is fully compromised, what should it still be unable to reach? The answer produces a short list.

Users: workstations and laptops. Can reach servers on specific ports, the internet through the firewall, and printers. Cannot reach each other or management interfaces.
Servers: file, application and database servers. Accept connections from Users on application ports only. Initiate outbound only for updates and backups.
Management: hypervisor consoles, iDRAC and iLO, switch and firewall admin, backup server console. Reachable only from a jump host or an admin VLAN, never from Users.
Guest and personal devices: internet only. No route to anything internal. Client isolation on so guests cannot see each other.
OT and IoT: cameras, door controllers, HVAC, printers, smart TVs. Internet access only if the device needs it, and no route inbound to Servers or Users except the one system that manages them.
Backup: the backup server and its storage. Accepts connections from the hosts it protects, initiates to nothing on the user side.

Building it on common hardware

Every managed switch made in the last fifteen years supports VLANs, and every business firewall can route between them with rules. The setup is the same in principle on Cisco, MikroTik, Ubiquiti, SonicWall and DrayTek; only the menus change.

The firewall does the routing between VLANs so it can enforce rules. The switch only carries tagged traffic. This is sometimes called router-on-a-stick and it is fine for networks up to a few hundred devices.

Plan addresses first: a /24 per VLAN with a memorable pattern, such as 10.10.10.0/24 for Users, 10.10.20.0/24 for Servers, 10.10.99.0/24 for Management.
Create the VLANs on the switch and set a trunk port to the firewall carrying all of them tagged.
Set access ports: user desk ports untagged in the Users VLAN, server ports in Servers, camera and printer ports in OT.
Create a VLAN interface on the firewall for each, with DHCP for Users, Guest and OT, static for Servers and Management.
Build the inter-VLAN firewall rules, default deny, then allow the specific flows.
Move devices one zone at a time and watch the deny log for anything you missed.

# MikroTik RouterOS: default-deny between VLANs, allow Users to Servers on SMB
/ip firewall filter
add chain=forward action=accept connection-state=established,related
add chain=forward action=accept in-interface=vlan10-users out-interface=vlan20-servers protocol=tcp dst-port=445 comment="Users to file server"
add chain=forward action=accept in-interface-list=LAN out-interface-list=WAN comment="internet"
add chain=forward action=drop in-interface-list=LAN out-interface-list=LAN log=yes log-prefix="inter-vlan drop"

The rules that matter for ransomware

The value of segmentation is in a small number of rules that break the attacker's usual path. Get these right and the rest is refinement.

Users to Users: deny. Workstations have no business reaching each other. This stops worm-style spread and pass-the-hash between PCs. Enforce it on the firewall between VLANs and with Windows Firewall inside the VLAN.
Users to Management: deny, including RDP, SSH, HTTPS to the hypervisor and the firewall admin port. Admins reach management from a jump host or dedicated admin VLAN.
Users to Servers: allow only what applications need. SMB to the file server, HTTPS to the intranet app, the database port to nothing (the application server talks to the database, not the user).
Servers to the internet: allow updates and specific SaaS. Deny everything else and log it. A server that suddenly wants to reach a new address on port 443 is worth a look.
Anything to Backup: only backup traffic from the protected hosts. RDP to the backup server from Users is the rule to delete today.

Wi-Fi, guests and remote users

Wireless is where segmentation usually leaks. One SSID with a shared password, used by staff laptops, personal phones and visitors alike, puts them all in the same zone. Split it.

Corporate SSID with WPA2-Enterprise or WPA3-Enterprise, authenticating against RADIUS with computer certificates, mapped to the Users VLAN. Guest SSID mapped to the Guest VLAN with client isolation and a captive portal if you want one. A third SSID for OT devices that only speak Wi-Fi.

Remote users on the VPN land in their own zone with the same rules as Users. A VPN that drops people onto the Servers VLAN with full access is a flat network with extra steps.

Turn on 802.1X on wired ports where the switch supports it, so an unknown device plugged into a wall jack lands in Guest, not Users.

Frequently asked questions

Will segmentation slow the network down?

Inter-VLAN traffic passes through the firewall, so its throughput becomes the limit for traffic between zones. Business firewalls handle this comfortably for typical file and application traffic. If a workload moves very large volumes between two zones, put both ends in the same zone or route that pair on a layer 3 switch.

We have one unmanaged switch and a consumer router. Where do we start?

A managed switch and a business firewall are the entry ticket. Ubiquiti, MikroTik and similar gear makes this affordable for a small office. RackLedge designs and installs this in a day for most small sites.

Do printers really need their own zone?

Printers run old embedded web servers, rarely get firmware updates, and are a common place for attackers to hide. Putting them in OT with a rule that only allows print traffic from Users costs nothing and removes one hiding spot.

Takeaway

Five or six zones, default deny between them, and a short list of allowed flows. Workstations cannot reach each other or the management plane, guests reach only the internet, and the backup server accepts nothing from the user side. That is enough to turn a network-wide ransomware event into a one-zone problem.