VLANs for the Homelab: A beginner's guide to segmenting networks

I tried to condense the many hours I spent learning what VLANs are and how to implement them, trying to focus on the important information.
What is a VLAN?
A VLAN is short for Virtual LAN. A VLAN is an isolated broadcast domain. If it doesn't mean anything to you, we are able to just call it an isolated segment or isolated section of a network, where devices on that segment can not "see" devices on other segments.
One way which has helped me to grasp this idea is thinking about mDNS or DLNA devices (another little rabbit hole to decrease, but for now stick to me). Think about a wireless printer or perhaps a Chromecast. These devices usually use technology which allows them to "magically" appear on your phone if you're connected to the same network. That's because your phone (or laptop) and the Chromecast or printer are in the same broadcast domain or segment. If your laptop and your Chromecast were each in different segmented VLANs, it would be as if the Chromecast doesn't exist as far as your laptop is concerned.
Finally, a VLAN is not a subnet. That is imporant, we will touch on this in another post about inter-VLAN routing.
So it breaks my Chromecast. Why would I want to use it?
Within the case of attempting to print to a wireless printer from your work laptop, having each device in another network segment will be annoying, there are many valid use-cases for VLAN segmentations in the homelab or home newtworking setups, including:
Isolating work-from-home devices (such as a work laptop, printer) from personal devices
Isolating "production" servers from "staging" or "development" servers in case you are running some form of application on your homelab
Isolating IoT or untrusted devices - for instance having all of your Alexa or smart home devices connected on an isolated VLAN so that they can't "see" and spy on your internal network
Capability to finely control inter-VLAN routing - that is one we will touch on down the road, as VLANs allow a network administrator to establish rules for how different VLANs can connect to each other and with the internet - for instance a "kids" VLAN that doesn't have access to a specific game after 10PM
VLAN-aware Switches and Routers
Before we move in to more details about implementation, I would like to briefly discuss the hardware side. This will be a very high-level overview as there are plenty of resources for learning the specific "behind-the-scenes" of how VLANs work in networking hardware. I'm aiming to ensure it is easily understood for a newcomer or beginner.
Remember: Part of setting up VLANs is learning the quirks of one's particular equipment rather than to assume one vendor will be like another within their VLAN implementation. You will see different manufactures will have slightly different implementations, but the overall concept remains the same!
home networking
Why can't all routers and switches support VLANs, isn't it only a software thing?
Yes and no. At the end of the day, all a VLAN is really in practice is a tiny bit of extra information put into every "packet" of information traveling through your network. This information should be interpreted and treated accordingly by your equipment. This could be done in software or hardware. BUT, remember that our routers and switches are often not very powerful with regards to software tasks.
Network switches are low-power, efficient devices that do a straightforward job really efficiently with hardware. That is why a Mikrotik CRS-328 can switch 63gbps of traffic when it has a single 800 mhz CPU. When it needs to utilize its CPU to route traffic, like routing traffic from one VLAN to another, that throughput number falls to under 500 mbps.
There are 3 solutions to this problem:
Throw more power at it: a robust CPU are designed for VLAN tagging without much issue - think about a Proxmox or other virtualization server, which can handle VLAN traffic
Use hardware that is optimized for the duty: look for a "managed" switch that has Layer 2 capability if you just need simple VLAN capability or Layer 3 Hardware capability if you want the switch to be able to route traffic between different VLANs
Be OK with lower speeds or decreased efficiency. That is sometimes the answer, specifically for the homelab. For example, my travel router, a GL-AR750s has OpenWrt installed and can do VLAN filtering through software. I'm fine that this isn't the most efficient setup possible and value the convenience and cost effectiveness more in this situation. This may connect with many beginners, who've a router that can just be flashed with OpenWrt and handle VLANs through its CPU. It's still the same VLAN goodness, just slower and cheaper!
VLAN terminology glossary
Listed below are some important terms and concepts to understand. These can help you grasp diagrams and types of VLAN setups and translate them to your personal equipment:
VLAN ID/VID:
Here is the number, 1-4095 of the VLAN. That is used by networking equipment to identify and group members of the same VLAN together. It is important to realize that the quantity is all that matters. In the event that you label VLAN 10 "Sally" using one switch and VLAN 10 "Jimmy" on another, the only thing the switches really care about is the VID
Tag
A VLAN tag is really a little piece of information put into a packet that tells networking equipment which VLAN that packet belongs to.
Tagged
When setting up a VLAN-aware switch, you'll often come across the term tagged or untagged in the form of a checkbox or dropdown menu for every physical port on the switch or router (and sometimes the "CPU" is considered its own port, like regarding OpenWrt or "bridge" in the case of Mikrotik - this is very important to inter-VLAN routing which will be discussed later). When choosing "tagged" - you are indicating to the switch that the traffic on that port with the VID you are marking as TAGGED should keep its VLAN tag when it leaves/enters the switch.
If a VLAN is tagged on a port and you connect a non-VLAN aware device, that traffic will undoubtedly be invisible compared to that device, while a VLAN-aware device will be able to grab that traffic and filter it. This is ideal for trunking (also defined in this list).
Untagged (access port on Cisco)
The inverse of the aforementioned, you are telling the switch that traffic with the untagged VID will have its tag removed as it leaves the switch, so that it will show to the connected device as though it really is regular non-VLAN traffic.
PVID
This is the physical port VID. It is possible to think of this because the "default" VLAN ID for the port, and therefore packets coming into/leaving the switch without tag will be considered to be part of this VLAN. You could be confused by the point of this when you also have untagged/access ports. On Mikrotik in the event that you decide on a PVID for a port it will automatically show that VID as untagged on that port, without you having to manually add it. On my TP-Link T1600G I had to select a PVID for a port and choose a port as untagged. From what I could tell reading on forums, some vendors separate egress/ingress via untagged/PVID respectively. Just know to make sure with your documentation which pattern your equipment follows.
Trunk
This is one of the best and what I think may be the most powerful parts of VLANs, trunks. A trunk is formed when you tag multiple VIDs on a single port using one switch. This port may then be used to connect another VLAN-aware switch and be able to utilize the same VLANs on that switch too. A very real usage of this: I've 2 VLAN-aware switches in my network: a Mikrotik CRS-328 which is connected with a trunk port to a Mikrotik CRS-317. This allows me to use extend my network and also have the extra 10G SFP+ ports on the second switch, while still keeping the same network segmentation.