What is the threat/risk difference in opening multiple ports on one physical NIC on a home server vs creating VLANs and opening ports on each VLAN?

Question

I have a single home server with a single NIC. I intend to run numerous services -- some will be internet exposed, some will not. I don't know if I am going to run them as VMs or Docker container but it shouldn't matter for this question.

Say I ultimately need to open port:

• :1234 that'll accept traffic from the internet (using a port forward on my router)
• :6789 that'll accept traffic just from my local network

I figure I have two options:

1. open both ports :1234 and :6789 on eth0 of my server
2. use VLANs:
   1. create a 802.1Q trunk on eth0 of my server then
   2. create two VLANs:
      • eth0.10 - dmz
      • eth0.20 - trust
   3. open ports on the individual VLANs:
      • :1234 on eth0.10
      • :6789 on eth0.20

The way I see it, option 2 gives me more control on my router/FW for rules for traffic between two VLANs but I am wondering how much it matters if everything is ultimately going to the same ethernet port on the same server.

So I'm wondering from a risk/threat perspective, is one better than the other?

Answer 1

I don't see any security related reason to use VLANs in this case. As you said, you are exposing the same server either way after all.

Now, if you had multiple internal networks with different levels of trust, VLANs may be useful.