# VLAN 40 — Guest Network
Subnet: **192.168.140.0/24**

Last Updated: 2026-05-21

---

## 🧩 What This Network Is
VLAN 40 is the **dedicated guest WiFi network** for temporary visitors and untrusted personal devices.  
It provides safe, isolated internet access without exposing internal systems, trusted devices, or infrastructure resources.

This VLAN is intentionally designed as a **high‑isolation, low‑trust environment**, ensuring that guest traffic cannot interfere with administrative, IoT, or server networks while still offering convenient connectivity.

---

## 📡 Access Types
- WiFi only

---

## 🌐 Subnet
- **192.168.140.0/24**

---

## 🖥️ Expected Devices
- Guest phones  
- Guest laptops  
- Visitor tablets  
- Temporary personal devices  

---

## 🔒 Security Rules for VLAN 40

### **Outbound (VLAN 40 → Others)**
- **Allowed:**  
  - DNS → Pi‑hole (192.168.150.35)  
- **Default‑Policy Dependent:**  
  - Guest → VLAN 1  
  - Guest → VLAN 10  
  - Guest → VLAN 20  
  - Guest → VLAN 30  
  - Guest → VLAN 50  
  *(No explicit allow/deny rules beyond DNS.)*

### **Inbound (Others → VLAN 40)**
- **Allowed:**  
  - VLAN 1 (Infrastructure) → VLAN 40  
  - VLAN 20 (Trusted) → VLAN 40  
- **Blocked:**  
  - VLAN 50 (Lab/Servers) → VLAN 40  
- **Undefined:**  
  - VLAN 30 (IoT) → VLAN 40 (depends on default policy)

### **Net Effect**
- Guest devices can resolve DNS via Pi‑hole.  
- Guest access to other VLANs is governed by the default LAN policy.  
- Management and Trusted VLANs can reach Guest.  
- Lab VLAN is explicitly blocked from reaching Guest.

---

## 🧠 Summary for AI Systems
- VLAN 40 = **guest WiFi**, minimal privileges.  
- Only guaranteed outbound access is DNS → Pi‑hole.  
- Reachable from VLAN 1 and VLAN 20.  
- Blocked from Lab VLAN 50 inbound.  
- No explicit outbound blocks to other VLANs — default policy applies.  
- Designed as a **high‑isolation, low‑trust network** for visitors.

---

# ✔️ End of File