I have a single home server with a single NIC. I intend to run numerous services -- some will be internet exposed, some will not. I don't know if I am going to run them as VMs or Docker container but it shouldn't matter for this question.

Say I ultimately need to open port:

  • :1234 that'll accept traffic from the internet (using a port forward on my router)
  • :6789 that'll accept traffic just from my local network

I figure I have two options:

  1. open both ports :1234 and :6789 on eth0 of my server
  2. use VLANs:
    1. create a 802.1Q trunk on eth0 of my server then
    2. create two VLANs:
      • eth0.10 - dmz
      • eth0.20 - trust
    3. open ports on the individual VLANs:
      • :1234 on eth0.10
      • :6789 on eth0.20

The way I see it, option 2 gives me more control on my router/FW for rules for traffic between two VLANs but I am wondering how much it matters if everything is ultimately going to the same ethernet port on the same server.

So I'm wondering from a risk/threat perspective, is one better than the other?

  • The second one does mean an attacker can't connect to port 6789 from the internet Commented Dec 29, 2020 at 18:38
  • But I am opening 6789 on the server, not router, so it wouldn't be accessible from the internet. No? Commented Dec 29, 2020 at 18:47
  • the home router DMZ setting that I'm aware of automatically forwards all ports. Does your one not work that way? Commented Dec 29, 2020 at 18:50
  • I’m not forwarding all ports. Just the ports I need. Commented Dec 29, 2020 at 18:51

1 Answer 1


I don't see any security related reason to use VLANs in this case. As you said, you are exposing the same server either way after all.

Now, if you had multiple internal networks with different levels of trust, VLANs may be useful.

  • Thanks. I figure using VLANs gives me centralized logging cause everything is going through pfSense but that is about it. If you don't mind, I'll leave the answer unmarked for a few days to see if anyone else chimes in. Commented Dec 29, 2020 at 23:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .