I am moving this website from Vultr to my Proxmox Ryzen 5 3600 virtualization server at home because it is cheaper and I no longer need to host my applications externally.

To protect my home network, I isolated the web server from my home network traffic. This way, even if the website is compromised, my home network will likely be safe from any attacks.

The server doesn’t require much to run. It has run on almost always the cheapest hardware/software available on various cloud platforms for years.

The main problem was that I didn’t get around to making a VLAN to isolate traffic at a network level from my home network.

Having a VLAN allows you to isolate networks, which I will use to split my home network and the network used by the web server VM.

You can read more about my home network here but it needs a bit of an update.

Preparing a backup of WordPress

This website runs on WordPress. WordPress makes backup/restore easy as import/export tools are built-in.

To keep costs down, I have a small WordPress site. Jetpack (I think) compresses and serves images, and almost all media is not hosted on the VPS directly.

I will need to simply download everything from the admin panel and then upload it to the clone.

I also want a new copy of WordPress because it’s been a while, my first article is from 2014 for example.

Setting up a Home VLAN for the VM

I have a VM running on my home server and disallow the VM to communicate with other devices on my home network but allow access to the internet.

External devices are prevented from being able to connect to the VM using my Ubiquiti router firewall.

I have a few VLANs going around the house so it was just a case of passing the new VLAN over ethernet tagged with its regular traffic to the VM and then using Proxmox to connect the VM using the same tag.

Configuring Proxmox to use the Tagged VLAN Trunk

Because I have not used a VLAN before to tag traffic to Proxmox. All of my previous VMs used the same network as Proxmox.

I was able to set the port the Proxmox server used as both a tagged trunk for VLAN 70 and an untagged on VLAN 20.

The way my home network is set up, all LAN traffic arrives at my switch on VLAN 20 and then VLAN 20 is untagged to devices such as my server.

Non-VLAN 70 VMs will be able to access VLAN 70 traffic but not vice versa. I am okay with this as I trust my home VMs.

I hope you enjoyed reading as much as I enjoyed setting this up.