Design and Implementation of a Secure Segmented Network Architecture for Nigerian SMEs Using pfSense and VLAN Technology
DOI:
https://doi.org/10.70112/ajcst-2026.15.2.4480Keywords:
Pfsense, VLAN Segmentation, Network Security, SME Cybersecurity, Firewall Policy, NigeriaAbstract
Small and medium-sized enterprises (SMEs) in Nigeria are increasingly dependent on computer networks for communication, data storage, and day-to-day business operations. Yet, a large proportion of these organisations continue to run flat, unsegmented networks with no internal boundary between departments, guests, and critical systems. This arrangement leaves them exposed to unauthorised access, malware propagation, and lateral movement once a single device on the network is compromised. At the same time, the cost and technical demands of commercial security appliances place conventional segmentation solutions out of reach for most SMEs. This study designed and implemented a secure, segmented, multi-tenant network architecture for Nigerian SMEs built around pfSense, an open-source firewall and routing platform, and IEEE 802.1Q Virtual Local Area Network (VLAN) technology. pfSense was configured as the centralised hub through which all routing, Dynamic Host Configuration Protocol (DHCP) allocation, Network Address Translation (NAT), and firewall policy enforcement passed, while three VLANs—Administration, Finance, and Guest—represented logically isolated departmental segments that shared the same physical infrastructure. The system was built and tested in a virtualised laboratory environment using Oracle VirtualBox, with Kali Linux client machines representing departmental and guest endpoints. Evaluation covered DHCP address allocation, gateway reachability, permitted and denied inter-VLAN communication, guest isolation, and outbound internet access. The results showed that each VLAN received correctly scoped DHCP addressing, and the Administration segment was able to reach Finance resources as permitted by policy. At the same time, the reverse path was blocked; the Guest segment was completely denied access to internal departmental resources while retaining internet connectivity via Automatic Outbound NAT, and all gateway and internet-reachability tests recorded zero packet loss. These findings demonstrate that centralised firewall enforcement, combined with VLAN-based logical segmentation, can deliver enterprise-grade network isolation for Nigerian SMEs using only open-source software and standard commodity hardware, without the licensing fees or specialist staffing that conventional segmentation projects typically require.
References
[1] W. Owoko, “Security schemes for the next-generation networks: A survey,” GSC Adv. Res. Rev., vol. 21, no. 2, pp. 427–455, 2024, doi: 10.30574/gscarr.2024.21.2.0446.
[2] T. Mbona and J. Eloff, “Semi-supervised approaches for mitigating internal network threats using segmentation techniques,” Int. J. Cybersecurity Res., vol. 11, no. 4, pp. 303–317, 2022.
[3] D. Álvarez, P. Nuño, C. T. González, F. G. Bulnes, J. C. Granda, and D. García-Carrillo, “Performance analysis of software-defined networks to mitigate private VLAN attacks,” Sensors, vol. 23, no. 4, p. 1747, 2023, doi: 10.3390/s23041747.
[4] M. Awan and A. Alam, “Cybersecurity threats and defensive strategies for small and medium firms: A systematic mapping study,” Administrative Sciences, vol. 15, no. 12, p. 481, 2025, doi: 10.3390/admsci15120481.
[5] J. Coquis-Flames, H. Flor-Cunza, and A. Alva-Mantari, “Design of a pfSense-based VLAN architecture for transitioning from proprietary to open-source firewalls,” Int. J. Eng. Trends Technol., vol. 72, no. 8, pp. 62–72, 2024, doi: 10.14445/22315381/IJETT-V72I8P108.
[6] IEEE, IEEE Standard for Local and Metropolitan Area Networks—Bridges and Bridged Networks, IEEE Std. 802.1Q-2018, 2018.
[7] A. Darshane, “Advanced network security concepts: Network segmentation and Zero Trust Architecture,” Int. J. Eng. Technol. Res., vol. 9, no. 2, pp. 379–386, 2024.
[8] S. Rose, O. Borchert, S. Mitchell, and S. Connelly, Zero Trust Architecture, NIST Special Publication 800-207, Nat. Inst. Standards Technol., Gaithersburg, MD, USA, 2020, doi: 10.6028/NIST.SP.800-207.
[9] Cybersecurity and Infrastructure Security Agency, Zero Trust Maturity Model, version 2.0, CISA, 2023.
[10] R. Chandramouli, Z. Butcher, Y. Li, and M. Nandiraju, A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments, NIST Special Publication 800-207A, Nat. Inst. Standards Technol., Gaithersburg, MD, USA, 2023, doi: 10.6028/NIST.SP.800-207A.
[11] S. Mushtaq, M. Mohsin, and M. M. Mushtaq, “A systematic literature review on the implementation and challenges of zero trust architecture across domains,” Sensors, vol. 25, no. 19, p. 6118, 2025, doi: 10.3390/s25196118.
[12] S. Arora and J. Hastings, “Microsegmented cloud network architecture using open-source tools for a zero trust foundation,” in Proc. 2024 17th Int. Conf. Security of Information and Networks (SIN), 2024, pp. 1–8, doi: 10.1109/SIN63213.2024.10871361.
[13] P. J. A. Jasis, R. J. N. Labis, and E. P. Ruaya, “Implementing VLAN segmentation for enhanced network security and performance in Barobo National High School,” Int. J. Adv. Trends Comput. Sci. Eng., vol. 14, no. 5, pp. 209–216, 2025.
[14] G. Sunkara, “The importance of network segmentation in security,” SAMRIDDHI: A J. Phys. Sci., Eng. Technol., vol. 17, 2025.
[15] Netgate, “VLAN configuration,” pfSense Documentation, 2025. [Online]. Available: https://docs.netgate.com/pfsense/en/latest/vlan/ configuration.html
[16] Netgate, “DHCPv4 server,” pfSense Documentation, 2025. [Online]. Available: https://docs.netgate.com/pfsense/en/latest/services/dhcp/ ipv4.html
[17] K. Scarfone and P. Hoffman, Guidelines on Firewalls and Firewall Policy, NIST Special Publication 800-41 Rev. 1, Nat. Inst. Standards Technol., Gaithersburg, MD, USA, 2009, doi: 10.6028/NIST.SP.800-41r1.
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2026 Centre for Research and Innovation
This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.
