Challenge

Most small businesses arrive at their network architecture by accident: a consumer-router deployment, a single shared Wi-Fi password, and an internet-exposed NAS server. In a flat LAN, a compromised IoT device or guest user can become a full business compromise.

For Apex Consulting Group, a 15-person professional services company, the issue was a classic flat-network model: one 192.168.1.0/24 subnet, no segmentation, default credentials on the edge router, and a port-forward exposing an internal NAS to the internet. The engagement focused on redesigning the environment into a defensible, least-privilege architecture.

Architecture

We replaced the single trust boundary with six purpose-defined VLANs and a default-deny firewall policy:

  • VLAN 10 (Staff): employee workstations with access only to approved business systems.
  • VLAN 20 (Servers): internal business servers, NAS storage, and log collection.
  • VLAN 30 (IoT): smart-office devices with restricted egress and no lateral movement.
  • VLAN 40 (Guest): isolated internet-only visitor Wi-Fi.
  • VLAN 50 (Management): privileged administrative access reserved for administrators.
  • VLAN 60 (Contractors): VPN-based remote access with scoped identities and revocation controls.

Testing and Validation

To prove the design worked, we built a Docker Compose lab that simulated the trust boundaries and a Python acceptance test suite to validate traffic flows. The checks included:

  • Staff and contractors can reach the internal wiki over HTTPS.
  • Guests and IoT devices are blocked from internal gateways.
  • Users cannot reach management interfaces without proper authorization.
  • Administrative access is restricted to approved administrator workstations.

We also documented the lab setup and validation workflow so it could be reproduced locally using a simple command sequence.

Key Lessons

The most important learning is that segmentation is not a single firewall rule—it is a system of switch VLANs, firewall policy, SSID isolation, remote-access controls, and endpoint discipline working together. Identity and access must be managed with lifecycle controls; a VPN key alone is not sufficient security. In other words, enterprise security comes from disciplined enforcement, not just nice diagrams.