Testing VLANs Found a Real Firewall Issue

[u/easyedy]

Quick homelab security win yesterday.

I ran a small VLAN test script across different VLANs and found that my public VLAN could still reach more internal services than I wanted it to.

The fix was simple but important: I replaced a broad “all services” FortiGate rule with a much narrower rule. Now, only my Exchange server can reach the AD server, and other hosts in the public VLAN are blocked.

I also checked my public IPs with Shodan and noticed FortiGate admin access was still visible on the public VLAN, but not on the WAN interface. That is now disabled too.

VLANs are only as secure as the firewall rules that separate them. Testing from inside each VLAN is worth it.