Network Segmentation Guide for SMBs
How to implement network segmentation in small and medium business environments — VLANs, firewall rules, and micro-segmentation.
Network segmentation is one of the most effective controls against lateral movement — and one of the most commonly skipped in SMB environments. "It's too complex" and "we're too small" are common objections, but modern network equipment makes basic segmentation straightforward, and the security benefit is enormous.
Why Segment?
In a flat network (all devices on one subnet), a compromised workstation can directly communicate with every server, every printer, every IoT device, and every other workstation. Ransomware exploits this to spread rapidly across the entire network.
With segmentation, the compromised workstation can only communicate with devices in its segment. To reach the server segment, traffic must pass through a firewall that enforces access rules. This dramatically slows lateral movement and gives your detection tools time to catch the threat.
Basic Segmentation Architecture
For most SMBs, four segments provide a strong security improvement:
User Workstations (VLAN 10): Employee laptops and desktops. Can access servers, internet, and printers. Cannot directly access other workstations (host isolation).
Servers (VLAN 20): File servers, application servers, domain controllers. Access restricted to specific ports from the workstation segment. No direct internet access.
IoT/OT (VLAN 30): Printers, cameras, HVAC controls, badge readers, smart TVs. Internet access restricted to vendor update servers. Cannot access server or workstation segments.
Guest WiFi (VLAN 40): Complete isolation. Internet access only. Cannot communicate with any internal segment.
Implementation Steps
Step 1: Create VLANs on your managed switches and configure ports. Most modern managed switches support VLANs with minimal configuration.
Step 2: Configure inter-VLAN routing on your firewall (not the switch). This ensures all cross-segment traffic passes through firewall rules.
Step 3: Define firewall rules for cross-segment traffic. Start permissive and tighten over time: log all cross-segment traffic for a week, identify legitimate flows, then create specific allow rules and default-deny everything else.
Step 4: Test thoroughly. Verify that all business applications work across segments. Test printers, file shares, and remote access.
For MSPs, network segmentation is a one-time project per client that provides ongoing security value. Document the architecture, firewall rules, and VLAN assignments in your IT documentation platform, and monitor for configuration drift.