2026-08-31

Best Managed Switch with VLANs for Beginner Homelab Under $100 (Pi and Docker Friendly)

For a beginner homelab running a Pi and Docker containers, the TP-Link TL-SG108E is the easiest and cheapest path to proper VLAN segmentation — typically around $30 and genuinely functional for the job. The Netgear GS308E and MikroTik CSS326 are also worth considering depending on how deep you want to go, but each has real trade-offs I'll break down below.

Why VLANs Actually Matter on a Pi Homelab

If you're running Docker containers on a Pi — say Pihole, Home Assistant, a reverse proxy, and a media server — everything shares one flat network by default. That means your IoT thermostat, your kid's tablet, and your self-hosted Nextcloud instance are all neighbors with no fences. VLANs let you segment traffic at Layer 2 so compromised IoT devices can't sniff traffic headed for your Docker services.

On my own build — a Raspberry Pi 5 Model B Rev 1.1 running Debian GNU/Linux 13 (trixie) on kernel 6.18.34+rpt-rpi-2712 with 15Gi RAM — I run multiple Docker containers off an NVMe boot drive (Fanxiang S501Q 512GB, mounted via the Pi 5's PCIe slot at gen2 default). Real sequential throughput: 453 MB/s read, 438 MB/s write, with 16,433 random 4K read IOPS. The SoC idles at 49.4°C and actually dropped slightly to 48.8°C under sustained load (active cooling doing its job). The point: this Pi is fast enough that the network — not storage — becomes the bottleneck if you're still on a dumb gigabit switch with no segmentation.

A managed switch with 802.1Q VLAN tagging lets you create tagged trunk ports to the Pi's single Ethernet interface. Linux handles VLAN subinterfaces natively (ip link add link eth0 name eth0.10 type vlan id 10), so your Pi can route or serve traffic on multiple VLANs simultaneously without extra NICs.

The Three Switches Worth Considering

TP-Link TL-SG108E (~$30)

TP-Link TL-SG108E 8-Port Easy Smart Switch

Based on published specs and widespread community reports (I haven't bench-tested this switch myself), this is the default recommendation for beginners, and for good reason:

• 8 gigabit ports, 802.1Q VLAN tagging, port-based VLANs, IGMP snooping
• Web GUI is basic but functional — no CLI, no SSH
• Managed via a browser-based interface (older hardware revisions required a Windows utility; current v6+ hardware uses a standard web UI)
• Fanless, tiny, metal case, virtually silent
• No SNMP on some firmware versions, limited QoS options

The management interface is not sophisticated. You won't get per-port traffic graphs or deep ACLs. But for creating 3–4 VLANs (e.g., trusted LAN, IoT, guest, management), it works and doesn't require reading a 400-page manual.

Netgear GS308E (~$35)

Netgear GS308E 8-Port Plus Switch

Reportedly very similar in capability to the TL-SG108E. Key differences based on specs and community feedback:

• Also 8 gigabit ports with 802.1Q VLAN support
• Web-based management (Netgear calls it "Plus" managed)
• Slightly more polished UI than the TP-Link, reportedly
• Some users report firmware update processes being clunkier
• Plastic housing on most versions (versus TP-Link's metal)

Honestly, between the GS308E and TL-SG108E, the functional difference is minimal. Pick whichever is cheaper at time of purchase. Neither gives you a CLI.

MikroTik CSS326-24G-2S+RM (~$90–100)

This is a different category entirely. Based on published specs:

• 24 gigabit ports plus 2 SFP+ 10G ports in a 1U rackmount form factor
• Full SwOS with a real web interface, more granular VLAN control, port mirroring, bandwidth limiting
• The SFP+ ports are genuinely useful if you ever add a NAS or a second node with a 10G NIC
• Fanless
• Steeper learning curve — not hard, but not point-and-click-obvious either

If you know you're going to expand beyond a Pi and a few devices — maybe adding a used Dell Optiplex running Proxmox, a NAS, or a second Pi — spending the extra $60 now saves you from replacing the 8-port switch in six months.

How VLAN Trunking Works with a Pi 5

On my Pi 5 running Debian Trixie, setting up VLAN subinterfaces is straightforward. After connecting the Pi to a tagged trunk port on your managed switch:

sudo ip link add link eth0 name eth0.10 type vlan id 10
sudo ip addr add 10.0.10.1/24 dev eth0.10
sudo ip link set dev eth0.10 up

For persistence across reboots, define the interfaces in /etc/network/interfaces or via a netplan config. Docker containers can then bind to specific VLAN interfaces using macvlan or ipvlan network drivers, giving each service its own VLAN presence.

With my NVMe boot drive delivering 453 MB/s sequential reads, the storage layer isn't a constraint — the Pi's single gigabit Ethernet port (roughly 940 Mbps practical throughput) is the ceiling. VLANs don't reduce that throughput in any meaningful way; tagged frames add 4 bytes of overhead per packet.

Who Should NOT Buy a Managed Switch Yet

• If you run fewer than 5 devices total, a dumb switch is fine. VLANs add complexity you don't need.
• If you want firewall rules between VLANs, a managed switch alone won't do it. You need a router or firewall (OPNsense, pfSense, even the Pi itself) doing inter-VLAN routing. The switch just handles the tagging.
• If you need PoE for access points or cameras, none of these three switches provide it. You'd need a TP-Link TL-SG108PE or similar, which runs closer to $70.

Practical Tips

Keep your switch firmware updated — all three vendors have had VLAN-related bugs in past firmware versions. Document your VLAN IDs and port assignments somewhere (even a text file in your homelab Git repo). Start with just two VLANs: a trusted LAN and an IoT VLAN. Add more only when you have a real reason.

If you're cloning or reimaging your Pi's NVMe drive during setup experiments, an external NVMe enclosure saves time over reflashing. I keep one around for exactly this purpose: M.2 NVMe SSD Enclosure – USB-C 10Gbps with Magnetic Closure.

For a deeper walkthrough on building and configuring a Pi-based homelab from scratch — including network segmentation, Docker orchestration, and the AI agent setup I run on my own Pi 5 — take a look at The Homelab Agent Kit — 9 AI Agents, 13-Chapter Build Guide, Python.

Verdict

The TP-Link TL-SG108E is the right first managed switch for most beginners — it's $30, it does 802.1Q VLANs, and it won't fight you during setup. If you're already planning to grow past 8 ports or want SFP+ uplinks, skip straight to the MikroTik CSS326 and save yourself a replacement cycle. Either way, VLANs on a Pi 5 running Docker are trivially easy on the Linux side — the switch is just the piece that makes the segmentation real on the wire.