Best managed switch for VLANs in a homelab

Your camera needs to reach the recorder. Your guest laptop does not need to reach the NAS. A managed switch lets those cables share one tidy box without turning the whole lab into one big network party.

Choose TP-Link TL-SG108E for a small gigabit desk lab, NETGEAR MS308E for eight 2.5GbE copper ports, GS305EP for a small PoE camera group, or Zyxel XMG1915-10E for 2.5GbE access plus 10G SFP+ uplinks. The right pick is the one with the ports and controls your plan actually uses.

Specs and setup details come from maker manuals and official OPNsense documentation.

Four switches, four jobs

Pick	Ports	802.1Q / VLAN capacity	Management	IGMP snooping	PoE	Cooling
TP-Link TL-SG108E — gigabit desk lab	8 × 1GbE	Yes; 32 simultaneous	Local web UI; utility available	v1/v2/v3	None	Fanless
NETGEAR MS308E — multigig copper	8 × 2.5GbE	Yes; 64	Local web UI	v1/v2/v3	None	Fanless
NETGEAR GS305EP — camera corner	5 × 1GbE	Yes; 64	Local web UI; per-port PoE controls	v1/v2/v3	4 powered ports; 30W/port, 63W shared	Fanless
Zyxel XMG1915-10E — faster uplinks	8 × 2.5GbE + 2 × 1G/10G SFP+	Yes; 1K static VLANs	Standalone web UI or Nebula cloud	v1/v2/v3	None	Fanless

The figures are from TP-Link’s TL-SG108E specifications, the MS308E datasheet, the GS305EP datasheet’s model column and the Zyxel XMG1915 series datasheet. These picks use 802.1Q tagging, rather than only port-based grouping.

Small desk lab: TP-Link TL-SG108E

Give a few servers, a printer and an IoT bridge their own lanes without upgrading every connection. The TL-SG108E supplies eight gigabit sockets and a browser interface for VLAN configuration. One router connection leaves seven sockets for endpoints.

Its 32 simultaneous VLANs easily cover the five-network example below. You are buying manageable gigabit ports, not PoE or an SFP+ backbone. Be precise about the model: TL-SG108E, with the E, is the pick here.

2.5GbE devices, copper everywhere: NETGEAR MS308E

Choose MS308E when your NAS and mini PCs already have multigig ports and you want segmentation alongside that faster link. All eight copper ports support 2.5GbE; you do not have to reserve one special socket for the NAS.

The MS308E manual separates basic and advanced 802.1Q modes. Advanced mode exposes tagged, untagged and excluded membership plus PVID settings—the controls used to describe the port plan below. For a broader speed-first comparison, use our 2.5GbE switch guide.

Small PoE camera group: NETGEAR GS305EP

GS305EP puts four powered gigabit ports beside a fifth gigabit connection for the uplink. Its 802.3af/at PoE+ support supplies up to 30W per powered port, with 63W shared across the switch.

For a simple planning example, four cameras allocated 12W each use 48W, leaving 15W. Those are assumed allocations; use each camera’s required power when filling your own plan. Both the per-port limit and the shared total must work.

The useful combination is local VLAN configuration and per-port power control. Our PoE switch guide for Frigate cameras handles camera power and port-count choices in detail, while the Frigate camera guide covers the endpoints.

2.5GbE plus a 10G backbone: Zyxel XMG1915-10E

Pick XMG1915-10E when a faster NAS or server deserves its own SFP+ connection, while smaller hosts stay on 2.5GbE copper. Its two SFP+ slots give you room for a server and an upstream switch. Choose a compatible DAC or optics for those slots; they are not copper RJ45 sockets.

Use the standalone browser interface if you want to manage the switch locally. Nebula is the optional cloud route. This 10E model supplies no PoE; the similarly named 10EP is a different power-providing model.

For the host side, our 10GbE NIC guide covers card, driver and slot fit. You do not need to turn every endpoint into a 10G machine to make one faster storage connection useful.

What VLANs do—and where the firewall fits

Think of a VLAN as a separate Ethernet group. IoT devices, cameras, guests and lab servers can occupy different groups on the same switch. An ordinary endpoint sends untagged traffic; its access port puts that traffic into the intended group. A tagged uplink carries several groups between VLAN-aware devices.

Three controls do different jobs:

• Membership: which VLANs may use this port.
• Tagged or untagged egress: whether frames leave the port carrying a VLAN tag.
• PVID: which VLAN receives incoming untagged frames.

VLANs separate traffic; your router/firewall decides what crosses between them. OPNsense’s VLAN setup guide explains the routed boundaries and firewall rules. Keep inter-VLAN routing on that firewall, rather than enabling routing on the switch. Our Protectli vs Qotom firewall guide helps you choose the box at that boundary.

For Wi-Fi clients, you also need an AP/router that maps SSIDs to the intended VLANs. Match that feature to your model using the Wi-Fi 7 router guide; a switch cannot assign separate wireless networks on behalf of an unaware AP.

A worked port plan: one uplink, four device groups

Here is a fictional XMG1915-10E plan: IoT 10, cameras 20, lab 30, guests 40, management 99. The router must have matching VLAN interfaces, address/DHCP settings and firewall rules before clients can use those networks.

Switch port	Connection	Tagged VLANs	Untagged VLAN	PVID / incoming frames
1	Router/firewall trunk	10, 20, 30, 40, 99	None	Tag Only; PVID unused for admitted traffic
2	IoT endpoint	None	10	10; Untag Only
3	Camera	None	20	20; Untag Only
4	Lab host	None	30	30; Untag Only
5	Guest wired endpoint	None	40	40; Untag Only
8	Trusted administration laptop	None	99	99; Untag Only

Ports 6 and 7 stay unplugged until assigned; the SFP+ slots are unused in this example. Each access port belongs only to its listed VLAN. Port 1 carries only the five listed tagged VLANs, with no native/untagged VLAN on the router end either.

Follow the Zyxel manual’s static VLAN, port setup and management-IP sections:

1. Back up the switch configuration and keep your current administration connection while creating the VLANs.
2. Set the listed ports as fixed members of each VLAN. Enable TX Tagging on port 1; leave it off for the listed access port in that VLAN.
3. Give port 8 PVID 99 and move the switch’s management IP interface to VID 99 under SYSTEM → IP Setup. Verify access from the administration laptop before removing the old path.
4. Set the remaining access-port PVIDs, Untag Only admission on those ports, Tag Only on port 1, and Ingress Check on the used ports. Mark membership in VLAN 1 and every other unwanted VLAN Forbidden on the used ports. A new PVID does not remove old membership.
5. Leave Zyxel’s separate VLAN Trunking option off: that option passes unknown VLANs. Your explicit membership and tagging settings already build the required uplink. Click Apply, then Save to retain the configuration after power loss.

The NETGEAR manuals use T, U and E for tagged, untagged and excluded membership. Use those labels for the same membership jobs; the table above uses Zyxel’s controls.

Test the boundary, not just the address

Move one test client between the access ports. Renew its network configuration each time and verify that it gets the intended network’s settings. Then test the services you actually allowed: a camera should reach its recorder; a guest should reach the internet but fail to open a lab service you blocked.

Test both IPv4 and IPv6 if you enable both. Check the firewall log when a blocked connection unexpectedly succeeds, and inspect VLAN membership when a client lands in the wrong group. Keep switch administration available only through your intended management path. Finally, restart the switch during a maintenance window and repeat the checks to verify the saved configuration.

Start with the ports you need, make one group work, then add the next. A well-planned VLAN setup gives every cable a job—and keeps the guest laptop out of your NAS party.