A flat network, where the printer, the domain controller and a guest’s laptop share one subnet, has one advantage: nobody has to design it. It also has one disadvantage that shows up exactly once: the first infected computer sees everything on the network, and nothing along the way records that it tried to reach the file server at three in the morning.
A VLAN is not segmentation
A common mistake is to equate segmentation with creating VLANs. A VLAN on its own splits the broadcast domain and nothing else. If traffic between VLANs passes through a router with no rules, the network is still flat from a security standpoint, just with more subnets to document.
Segmentation is three things together:
- a split into segments with different trust levels,
- traffic between segments passing through a device that can filter and log it,
- rules that block by default and explicitly allow only what is needed.
Without the third point, the first two are cost without benefit.
The minimal set of segments
For an organisation without a network team, five or six segments work well:
- Users: employee workstations and laptops. They reach services, not servers as such.
- Servers: internal services, domain controllers, databases. If some services are exposed to the internet, separate those into their own segment.
- Management: hypervisor interfaces, switches, power units, server remote consoles, the backup system. Reachable only from designated admin workstations or a jump host.
- Guests and IoT devices: printers, cameras, phones, meeting room displays. Internet access plus specific print services, nothing else.
- Cluster and containers: their own address space, with inbound traffic through defined entry points rather than the addresses of individual nodes or pods.
- External links: the zone where internet traffic enters and leaves, separated from the rest.
When there are too many segments
The rule is simple: a new segment makes sense only when its policy differs from that of the existing segments. A VLAN per department, when all departments have identical access, is extra configuration with no effect. A VLAN per server application is justified in environments with strict audit requirements, but in a small company it means dozens of rules nobody will maintain.
Signs that the split is too fine: rules between segments contain “allow all” because nobody knows what exactly is needed; adding a new server requires changes in several places; documentation no longer matches the configuration.
Rules that work
- Deny by default. Every allow rule has an owner and a reason. A rule without a justification gets removed.
- Allow services, not segments. Users can reach directory service ports, DNS, file shares and specific applications. Not “the whole server segment”.
- Management from one place only. There is one path into the management segment: an admin workstation or a jump host, with multi-factor authentication.
- Log denied traffic. Denials between segments are one of the cheapest sources of information about what is happening on the network. An infected workstation scanning the server segment leaves a trace before anything succeeds.
- Review rules on a schedule. Once a quarter: what is used, what is not, what was added “temporarily” six months ago.
Summary
Segmentation is not a project that ends. It is a structure in which every new system lands in a segment with the right trust level and gets exactly the connections it needs. Five well-maintained segments limit the impact of an incident more than twenty that nobody understands.