VLANs for the Homelab: A beginner's guide to segmenting networks

I tried to condense the many hours I spent learning what VLANs are and how exactly to implement them, trying to focus on the important information.
What is a VLAN?
A VLAN is short for Virtual LAN. A VLAN is an isolated broadcast domain. If it doesn't mean anything to you, we can just call it an isolated segment or isolated part of a network, where devices on that segment cannot "see" devices on other segments.
One way which has helped me to grasp this idea is thinking of mDNS or DLNA devices (another little rabbit hole to go down, but for now stick to me). Look at a wireless printer or a Chromecast. These devices usually use technology that allows them to "magically" appear on your own phone if you're connected to the same network. That's because your phone (or laptop) and the Chromecast or printer come in exactly the same broadcast domain or segment. If your laptop as well as your Chromecast were each in different segmented VLANs, it will be as if the Chromecast doesn't exist so far as your laptop is concerned.
Finally, a VLAN isn't a subnet. That is imporant, we will touch with this in a future post about inter-VLAN routing.
So it breaks my Chromecast. Why would I wish to use it?
Within the case of attempting to print to a wireless printer from your work laptop, having each device in a different network segment would be annoying, there are many valid use-cases for VLAN segmentations in the homelab or home newtworking setups, including:
Isolating work-from-home devices (like a work laptop, printer) from personal devices
Isolating "production" servers from "staging" or "development" servers in case you are running some type of application on your homelab
Isolating IoT or untrusted devices - for example having all of your Alexa or smart home devices connected on an isolated VLAN so that they can't "see" and spy on your own internal network
Ability to finely control inter-VLAN routing - that is one we shall touch on down the road, as VLANs allow a network administrator to determine rules for how different VLANs can connect to each other and with the internet - for instance a "kids" VLAN that doesn't have access to a specific game after 10PM
VLAN-aware Switches and Routers
Before we move around in to more details about implementation, I wish to briefly discuss the hardware side of things. This will be an extremely high-level overview as there are many resources for learning the specific "behind-the-scenes" of how VLANs work in networking hardware. I'm aiming to make it easily understood for a newcomer or beginner.
Remember: Part of establishing VLANs is learning the quirks of your particular equipment rather than to assume one vendor will be like another within their VLAN implementation. You will see different manufactures could have slightly different implementations, however the overall concept remains exactly the same!
Why can't all routers and switches support VLANs, isn't it only a software thing?
Yes and no. At the end of the day, all a VLAN is really in practice is a tiny bit of extra information put into every "packet" of information traveling during your network. This information needs to be interpreted and treated accordingly by your equipment. This can be done in software or hardware. BUT, understand that our routers and switches are often not very powerful when it comes to software tasks.
Network switches are low-power, efficient devices that a simple job really efficiently with hardware. That's why a Mikrotik CRS-328 can switch 63gbps of traffic when it includes a single 800 mhz CPU. When it needs to use its CPU to route traffic, like routing traffic from one VLAN to some other, that throughput number falls to under 500 mbps.
There are 3 answers to this problem:
Throw more power at it: a robust CPU can handle VLAN tagging without much issue - look at a Proxmox or other virtualization server, that may handle VLAN traffic
Use hardware that's optimized for the task: find a "managed" switch that has Layer 2 capability if you just need simple VLAN capability or Layer 3 Hardware capability if you'd like the switch to manage to route traffic between different VLANs
Be OK with lower speeds or decreased efficiency. That is sometimes the answer, especially for the homelab. For instance, my travel router, a GL-AR750s has OpenWrt installed and is able to do VLAN filtering through software. I'm fine that this isn't probably the most efficient setup possible and value the convenience and cost effectiveness more in this situation. This may connect with many beginners, who have a router that can just be flashed with OpenWrt and handle VLANs through its CPU. It's still the same VLAN goodness, just slower and cheaper!
VLAN terminology glossary
arduino projects
Listed below are some important terms and concepts to comprehend. These can help you grasp diagrams and types of VLAN setups and translate them to your personal equipment:
This is the number, 1-4095 of the VLAN. That is used by networking equipment to identify and group members of the same VLAN together. It is very important realize that the quantity is all that matters. If you label VLAN 10 "Sally" on one switch and VLAN 10 "Jimmy" on another, the only thing the switches really value is the VID
A VLAN tag is really a little piece of information put into a packet that tells networking equipment which VLAN that packet belongs to.
When establishing a VLAN-aware switch, you'll often run into the term tagged or untagged by means of a checkbox or dropdown menu for each physical port on the switch or router (and sometimes the "CPU" is known as its own port, like in the case of OpenWrt or "bridge" regarding Mikrotik - this is important for inter-VLAN routing which will be discussed later). When selecting "tagged" - you're indicating to the switch that the traffic on that port with the VID you're marking as TAGGED should keep its VLAN tag when it leaves/enters the switch.
If a VLAN is tagged on a port and you connect a non-VLAN aware device, that traffic will be invisible compared to that device, while a VLAN-aware device can pick up that traffic and filter it. That is useful for trunking (also defined in this list).
Untagged (access port on Cisco)
The inverse of the above, you are telling the switch that traffic with the untagged VID will have its tag removed since it leaves the switch, so that it will show to the connected device as though it really is regular non-VLAN traffic.
This can be a physical port VID. You can think of this as the "default" VLAN ID for the port, and therefore packets coming into/leaving the switch without tag will be regarded as part of this VLAN. You may be confused by the point of the when you likewise have untagged/access ports. On Mikrotik if you select a PVID for a port it'll automatically show that VID as untagged on that port, without you needing to manually add it. On my TP-Link T1600G I had to select a PVID for a port and choose a port as untagged. From what I could tell reading on forums, some vendors separate egress/ingress via untagged/PVID respectively. Just know to be sure with your documentation which pattern your equipment follows.
This is one of the best and what I think is the most powerful elements of VLANs, trunks. A trunk is formed when you tag multiple VIDs about the same port using one switch. This port can then be used to connect another VLAN-aware switch and also utilize the same VLANs on that switch too. A very real usage of this: I have 2 VLAN-aware switches in my own network: a Mikrotik CRS-328 that is connected via a trunk port to a Mikrotik CRS-317. This allows me to use extend my network and have the extra 10G SFP+ ports on the next switch, while still keeping the same network segmentation.