Your work laptop might be sharing a network with everything else you own (provided you work from home sometimes, that is). That’s convenient, but it also gives a computer controlled by someone else’s IT department far more local access than it needs.

Don’t want your employer to ever get the chance to spy on you? A simple VLAN setup might do the trick.

Your work laptop shouldn’t share a LAN with your personal devices

A company-controlled computer belongs in a separate trust zone

A VLAN, or virtual local area network, lets one physical home network behave like several smaller, separate networks.

All your stuff can still use the same router, switches, and whatever other networking gear you have at home; it just gets split into different logical groups, usually with their own IP address ranges. Traffic moving from one LAN to another has to pass through the router, where it can be allowed or blocked. It’s super helpful in many ways, although setting it up wrong can expose your entire network.

So, why would you want your work laptop to live on a separate network? Because it’s not really in your control the same way as your personal PC. Your employer is in charge of its security software, VPN client (if you’re even allowed to use one), firewall rules, certificates, updates, remote access tools, and background services. Simply put, it’s not your PC, even if you’ve held it for years now.

Of course, your job’s IT department isn’t spending its free time poking around your network and checking your smart cameras (at least I’d hope not). But the laptop may still be able to discover local devices and see shared folders, and I’d wager you probably don’t want that to happen.

Plus, the unpleasantness works both ways: just as your local network is exposed to your work through your laptop, your work laptop can also become vulnerable through your local network and put the company at risk.

The Unifi Dream Router 7.
UniFi Dream Router 7
9/10

Brand

Unifi

Range

1,750 square feet

Having a secure router is your first step to a safe network. The UniFi Dream 7 has received glowing recommendations from our reviewers.

$295 at B&H Photo Video
$279 at Unifi

Create one work VLAN and connect the laptop to it

One new network is all this setup needs

CachyOS open on a Surface Laptop.Credit: Nick Lewis / How-To Geek

Sorting this out should be super easy, so there’s some good news for you here. Not every basic router supports VLANs, though, so you’ll need a router or firewall that lets you create multiple networks and control traffic between them.

First, head into your router’s network settings and create a new virtual network called something obvious. Let’s go with Work.

Give it an unused VLAN ID, like VLAN 20, and its own IP address range, such as 192.168.20.0/24, then make sure DHCP is enabled so your laptop can receive an address automatically.

Of course, as is always the case with any network-related shenanigans, you’ll find that the exact menus depend on your router, so be ready to get curious. In most cases, you’ll find this under Settings > Networks.

Next, create a separate Wi-Fi name, and assign it to the VLAN you just made. Connect the work laptop to that Wi-Fi and make it forget your main network so it can’t just reconnect later. For a wired laptop, assign its managed switch port to the work VLAN instead.

Block the work VLAN from every private network

The firewall rule provides the actual protection

The top of the Unifi Dream Router 7.Credit: Patrick Campanale / How-To Geek

If you made the VLAN, you’re halfway there. Halfway, because your router may still allow traffic to pass between it and your other networks, and that’s the opposite of what we’re doing all this for.

Go back into the settings and look for something called Network Isolation, Block Inter-VLAN Traffic, or something along those lines, and enable it for your work VLAN.

If your router makes you create the rule manually, block traffic from the work VLAN to your home, IoT, camera, and any other private subnets. You should still allow it to reach the internet and any essential services supplied by your router, though, such as DNS.

Test the isolation first

Internet access alone doesn’t prove it’s all good

A Wi-Fi router with angled antennas.Credit: Ismar Hrnjicevic / How-To Geek

With your laptop all set up, check that it can still go online, then try reaching something on your private network. Let’s say, your router’s admin page, your NAS, or a different PC. To do this, find the local IP address of your router, then type it into the web browser and see whether the login page opens.

Those connections should fail. If your work uses a VPN, test with the VPN and without it, too.

I’m not saying your boss is spying on you, but why would you risk it?

In all likelihood, the IT department at your company couldn’t care less what’s happening on your network (unless it’s a danger to the laptop/work network itself). But that doesn’t mean you shouldn’t give your work laptop its own VLAN. Just like you should separate your private and work lives for the sake of staying sane, keeping your laptop on its own little lane has a lot of benefits and few downsides.

Adobe Express - file-1
TP-Link Tri-Band BE9700 WiFi 7 Router
$190
$250
Save $60

Brand

TP-Link

This TP-Link router doesn’t cost an arm and a leg, but it still gives you tri-band connectivity and Wi-Fi 7.

Wi-Fi Bands

Tri-Band

$190 at Amazon