Smart Home VLAN Segmentation

Network Defense

VLAN segmentation
IoT / trusted / guest kept on separate broadcast domains Guest ↔ IoT bridge (misconfigured)
Simulates a router that lets guest devices reach smart-home gear

Probe rate 1.0 / s

Attack Simulation

Live Stats

Blocked probes

Lateral moves

Compromised / total devices

0 / 10

Reachable segment-pairs (attack surface)

33%

Devices

How it works

Every device sits in one of three VLANs — Trusted, IoT or Guest — routed through a single gateway. What crosses between VLANs is decided by a firewall access-control list (ACL), not by physical wiring:

allow(src, dst) =
  true                          if src == dst        (same VLAN)
  true                          if src=Trusted, dst=IoT   (control traffic)
  false                         if src=IoT, dst=Trusted   (blocks IoT→Trusted pivot)
  bridge_flag                   if {src,dst} = {IoT, Guest}
  false                         otherwise (Guest⇄Trusted)

A compromised device (🦠) repeatedly probes a random other device. Each probe is checked against allow(src, dst): if false it is dropped at the gateway (counted as Blocked); if true it reaches the target, which then has a chance to itself become compromised — a lateral move. This is exactly how a worm like Mirai spreads between IoT devices, and exactly why the single rule "IoT cannot initiate to Trusted" is the one that keeps a hacked camera from touching your laptop.

Turn segmentation off — every allow() becomes true, so a single compromised bulb can eventually reach every device on the network.
Guest↔IoT bridge — a common real misconfiguration (one flat Wi-Fi router, no VLANs) that reopens the IoT⇄Guest path even with segmentation nominally on.
Attack surface — the share of the 9 ordered segment-pairs (including same-segment) currently reachable under the active ruleset.

Trusted VLAN IoT VLAN Guest VLAN Compromised device

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.