Thirty dollars buys a switch that does real 802.1Q VLANs now. That was true a few years ago too, but what you get for the money has shifted. The cheapest boxes all tag VLANs just fine. Where they differ is everything around the tagging: whether the admin page can be fenced into its own VLAN, whether it speaks HTTPS, and whether its setup protocol leaks the password to anyone on the same segment. Those are the questions that matter once you put IoT gear, guests and a homelab on one cheap VLAN switch.
What reframes the category in 2026 is TP-Link’s Omada Easy Managed line (ES205G, ES208G, ES216G). It launched in late 2024 and now sells within a couple of dollars of Easy Smart prices, but it adds a management VLAN, HTTPS and optional Omada controller adoption, three things the long-running TL-SG108E never had. Below are eight budget managed switches with VLAN support, from a $20 five-port up to a MikroTik with two 10G SFP+ uplinks. Each one has its VLAN limits, management gotchas and security history checked against the manufacturer’s own documentation.
Short answer: the best cheap VLAN switch for most homelabs is the Omada ES208G, at about $30. It is fanless, has eight gigabit ports and 32 VLANs, and it is the only sub-$30 eight-port switch here that can lock its admin page to a management VLAN. If you want the most VLANs per dollar, get the NETGEAR GS308E (64 VLANs in advanced 802.1Q mode). For a trunk to a NAS or Proxmox host at 10G, the MikroTik CSS318-16G-2S+IN is the cheapest serious option in stock.
Updated October 2026: prices and stock re-checked against the live Amazon listings. Specs, VLAN limits and firmware notes come from the TP-Link, Omada, NETGEAR, Zyxel and MikroTik datasheets, read in September 2026, and the PVID tests further down were run on Ubuntu 26.04.
Quick picks
- Best overall: Omada ES208G: 8 ports, a management VLAN, HTTPS and optional Omada controller support. About $28 to $32, check the live price.
- The classic budget pick: TP-Link TL-SG108E: the switch every homelab VLAN tutorial uses. It has no management VLAN. Around $25 to $30.
- Most VLANs under $30: NETGEAR GS308E: 64 VLANs (advanced 802.1Q mode) and two static LAGs on the current v4 hardware. Around $25 to $30.
- Best 5-port: Zyxel GS1200-5: a management VLAN, HTTPS and LACP for about $20 to $22.
- Best 16-port: TP-Link TL-SG116E: fanless, with eight static LAG groups. About $55 to $65.
- Best 24-port rackmount: TP-Link TL-SG1024DE: 19-inch rack ears, internal power supply, no fan. About $95 to $105.
- Best cheap PoE+ with VLANs: TP-Link TL-SG208PE: PoE+ on all eight ports from a 64 W budget. About $65 to $75.
- Best with 10G uplinks: MikroTik CSS318-16G-2S+IN: 16 gigabit ports, 2 SFP+ ports and 250 VLANs. About $140.
How these were picked
Every switch here does real IEEE 802.1Q tagging. That rules out the many “VLAN” switches that only offer port isolation, and it is the only kind of VLAN that lets a single trunk cable carry several networks to a router such as OPNsense. The price cap is roughly what a homelab or a small office will pay for access switching. The five- and eight-port picks are all under $35. The 16-port, 24-port, PoE and 10G picks cost more because of port count, power or uplinks, and each is the cheapest credible option in its class.
Each spec comes from the vendor’s datasheet, user guide or product page, fetched in September 2026. Where two TP-Link or NETGEAR documents disagreed (it happened several times: jumbo frame sizes, LAG support, power draw), the newer document won, and the pick sections say so. Prices and stock came from Amazon’s live catalog on the same day. Security history comes from NVD, the vendors’ own advisories and published research. We did not bench-test these eight units. The VLAN behaviour section further down is our own lab work: it reproduces the access, trunk and PVID logic these switches use, on a Linux bridge, with real output.
Three old favourites from earlier versions of this list are gone. The NETGEAR GS105Ev2 and GS108PEv3 reached end of sale in 2021 and 2023, and both have published CVEs against their firmware. The TRENDnet TEG-S80ES is discontinued and now only sells through third parties for well over $100.
Cheap VLAN switches compared
The columns are the specs that actually change the buying decision. “Mgmt VLAN” means the admin interface can be restricted to one VLAN, so a device on the IoT or guest network cannot reach the switch’s login page.
| Switch | Ports | 802.1Q VLANs | Mgmt VLAN | Link aggregation | Admin UI | Price band |
|---|---|---|---|---|---|---|
| Omada ES208G | 8x 1G | 32 | Yes | Static, 2 groups | HTTP/HTTPS, Omada | ~$28-32 |
| TP-Link TL-SG108E | 8x 1G | 32 | No | Static, 2 groups | HTTP, Windows utility | ~$25-30 |
| NETGEAR GS308E v4 | 8x 1G | 64 (advanced mode; basic is 8) | No (IP allow list) | Static, 2 groups | HTTP | ~$25-30 |
| Zyxel GS1200-5 | 5x 1G | 32 (assumed, from the 8-port user guide) | Yes | Static or LACP, 1 group | HTTPS | ~$20 |
| TP-Link TL-SG116E | 16x 1G | 32 | No | Static, 8 groups | HTTP, Windows utility | ~$55-65 |
| TP-Link TL-SG1024DE | 24x 1G | 32 | No | Static | HTTP, Windows utility | ~$95-105 |
| TP-Link TL-SG208PE | 8x 1G, all PoE+ | 32 | Not confirmed | Static | Web, Omada | ~$65-75 |
| MikroTik CSS318-16G-2S+IN | 16x 1G + 2x SFP+ | 250 | Yes (“Allow From VLAN”) | Static or LACP | HTTP (SwOS) | ~$140 |
1. Omada ES208G: best cheap VLAN switch overall
For about two dollars more than a TL-SG108E, the ES208G fixes the three complaints people have had about TP-Link’s budget switches for a decade.
It is an eight-port gigabit switch in a metal, fanless case, powered by a 5 V adapter. The datasheet puts maximum draw at 2.679 W. VLAN support is 802.1Q only, with 32 VLAN groups out of the full 4K ID range. That is the same ceiling as the Easy Smart line, and it is plenty for a home network split into trusted, IoT, guest, cameras and lab. The management side is where it pulls ahead. Omada’s Easy Managed user guide documents a management VLAN: once 802.1Q is enabled, “only PCs with management VLAN tags can access the management interface”. The web UI can run in HTTPS mode, and the switch supports LLDP, port isolation, loopback detection, IGMP snooping v1/v2/v3, mirroring and two static LAG groups of up to four ports.
Controller adoption is optional. The switch runs standalone from its own web page. If you already run Omada (a software controller, an OC200 or the free cloud tier), it can join that site, but it needs controller firmware 6.1.0 or later, so check that your controller (older OC200 hardware versions included) can run that release before counting on adoption. Batch configuration, the Omada app and QoS rules only work in controller mode. Owners on r/TPLink_Omada report one catch: the controller will not see Easy Managed switches until you tick the “Agile (Easy Managed)” series option in the site settings. If you are choosing between ecosystems, our Omada vs UniFi comparison covers the controller side.
Who it’s for: anyone buying a first VLAN switch today, especially if the switch will carry an IoT or guest network you do not trust. Skip it if: you need more than 32 VLANs, LACP instead of static LAG, or a large review history. The current Amazon listing has few reviews so far, because the model is new. It is about $28 to $32, check the live price on Amazon. Buy that listing: an older ES208G listing (B0DV9GYNLV) is out of stock. The five-port Omada ES205G (around $23 to $26) has the same management features.
2. TP-Link TL-SG108E: the classic budget VLAN switch
Every “set up VLANs at home” tutorial written in the last eight years uses one of these, which is its best feature.
The current hardware is V6. It has eight gigabit ports in a metal fanless case and supports 32 VLANs across MTU, port-based and 802.1Q modes. It also does IGMP snooping, two static LAG groups, port mirroring, cable diagnostics, loop prevention and 16 KB jumbo frames, and the V6.40 datasheet lists 2.71 W maximum draw. The VLAN modes are exclusive. TP-Link’s user guide says enabling one mode disables the other two “and the corresponding VLAN configuration will be lost”, so pick 802.1Q from the start.
The weak spot is the management plane. There is no management VLAN, so the admin page answers on whichever VLAN the switch’s IP lands in. Researchers documented on earlier hardware that the Windows Easy Smart Configuration Utility broadcasts its traffic to 255.255.255.255, encrypted with a key hard-coded in the firmware, so anyone on the same segment could capture the password during a management session. We found nothing showing that the current utility changed that design. Older firmware tied sessions to the client IP (CVE-2017-17746), which TP-Link said it would not fix. The web interface is the safer way to manage it. The V6.40 firmware TP-Link published in September 2026 addresses the CVE-2025-0729 clickjacking bug, so update it on day one.
Buy it for: learning VLANs on a network where every device on every VLAN is yours. Pass on it if: an untrusted VLAN (smart TVs, a guest network, cheap cameras) will share the switch. The ES208G costs a couple of dollars more and fixes the problem. It is about $25 to $30, check the current price.
3. NETGEAR GS308E: most VLANs for under $30
NETGEAR quietly dropped the “Plus” name in its February 2026 manual revisions, and the GS305E and GS308E are now “Easy Smart Managed Essentials” switches. The hardware underneath is what counts.
The GS308E v4 supports 64 VLANs (IDs 1 to 4093) in advanced 802.1Q mode. Basic 802.1Q mode is capped at one VLAN per port (eight), so switch to advanced mode before building a VLAN plan. It also has port-based VLANs. It has two static LAGs of up to four members, IGMP snooping v1/v2/v3, loop prevention, port mirroring from up to seven source ports and 9K jumbo frames, and the product page lists 3.7 W maximum draw. The 64-VLAN figure is a v4 change. NETGEAR’s 2021 datasheet listed 32 for the older GS308E, and that model’s retail SKU hit end of sale in 2022. So buy the Amazon.com listing, whose page names GS308Ev4, not a third-party relist. The same goes for the LAG feature: the May 2024 datasheet still says “No”, but the current product page and the July 2026 manual both document static LAG.
Like the TL-SG108E, it has no management VLAN. The manual only offers an IP-based access list for the admin page. It also has no HTTPS. NETGEAR told NCC Group in 2021 that HTTPS was “not possible” on this switch family’s hardware (that advisory covered sibling models, not the GS308E itself). No NVD entry currently names the GS305E or GS308E. The previous generation (GS105Ev2, GS108Ev3) collected several, which is one more reason to skip cheap listings of old stock.
Who it’s for: homelabs that number VLANs by subnet and like having room, or anyone who prefers NETGEAR’s UI. Skip it if: you need LACP or a management VLAN. About $25 to $30, see the live listing. The five-port GS305E (around $20 to $25) has the same 64 VLANs in advanced mode but no link aggregation.
4. Zyxel GS1200-5: best 5-port VLAN switch
This is the smallest and cheapest switch on the list, and on paper its management features beat several switches that cost more.
The v3 hardware ships with an HTTPS web interface (a self-signed certificate by default) and a configurable management VID from 1 to 4094. It supports LACP or static aggregation on one group (ports 3 and 4), IGMP snooping v1/v2/v3, loop prevention, port isolation, bandwidth control, mirroring and 15 KB jumbo frames, all fanless at 2.718 W maximum. Zyxel’s spec text does not state a VLAN count. The user guide screenshot shows a 32-VLAN maximum on the eight-port model, and we assume the same here.
There are two things to know before you plug it in. First, CVE-2026-4795 (May 2026) let anyone on the LAN read the switch configuration without logging in, on firmware up to 1.00(ACPS.2)C0. Zyxel has patched it, so update the firmware right away. Second, the user guide warns that removing every port from VLAN 1 before another VLAN has management access locks you out of the switch. Create the management VLAN first and move ports second. The eight-port GS1200-8 is the better box, but Zyxel’s own Amazon listing is out of stock and the only buyable one is a third-party seller asking about twice the usual price.
It suits a desk, a media cabinet or a rack shelf where five ports is enough and you want the admin page locked down. Look elsewhere if you need more than one LAG or more than a handful of ports. About $20 to $22 from Zyxel’s Amazon store, check the live price.
5. TP-Link TL-SG116E: best 16-port VLAN switch
Homelabs outgrow eight ports faster than anyone admits. A NAS, two Proxmox nodes, an access point, a camera NVR and a trunk to the firewall already use six.
The TL-SG116E is the TL-SG108E’s feature set doubled: 16 gigabit ports, a 32 Gbps switching fabric, 32 VLANs and up to eight static LAG groups of four ports, in a fanless metal case. It draws 9.19 W maximum from an external 12 V adapter. One real difference is jumbo frames. The current datasheet says 10,000 bytes (the product page says 9 KB), against 16 KB on the eight-port model, which matters if you run 9000 MTU storage traffic with headroom. It is a desktop or wall-mount unit, not a rackmount.
Who it’s for: a growing homelab on a budget where every device on the switch is trusted. Skip it if: you want a management VLAN. The Omada ES216G (about $75 to $85) adds one, plus rack ears and an internal power supply, but its Amazon listing has only a handful of reviews so far. The TL-SG116E is about $55 to $65, check the live price.
6. TP-Link TL-SG1024DE: cheapest 24-port rackmount VLAN switch
If the switch is going into a real 19-inch rack, the TL-SG1024DE is still the cheapest managed 24-port switch worth buying new.
It has 24 gigabit ports, a 48 Gbps fabric, an internal 100 to 240 V power supply (no power brick hanging off the back) and a rack-mount kit in the box, with no fan, at 13.66 W maximum. It uses the same Easy Smart firmware as the smaller models: 32 VLANs, static LAG, IGMP snooping, port mirroring and 10 KB jumbo frames. The 32-VLAN cap is more noticeable on a 24-port box, but it only bites if you really need that many separate networks.
Good fit: a rack that needs a lot of access ports, quietly. Poor fit: you need uplinks faster than gigabit or a management VLAN. At that point a used enterprise switch or the MikroTik below is the better buy. About $95 to $105, see the current listing. For short-depth racks, our 10-inch mini rack build uses smaller gear.
7. TP-Link TL-SG208PE: best cheap PoE+ switch with VLANs
Cameras and access points are the devices that most deserve their own VLAN, and they usually want power over the same cable.
The TL-SG208PE is TP-Link’s new Easy Managed PoE model. All eight ports deliver 802.3af/at PoE+ at up to 30 W each, from a 64 W total budget. Amazon’s title says 65 W; TP-Link’s spec page says 64 W. It supports MTU, port-based and 802.1Q VLANs (32 groups), IGMP snooping, static LAG, LLDP, eight QoS queues and PoE auto recovery, in a fanless case. Do the power maths before you fill it: two PoE+ access points at full draw use almost the whole budget, while a row of low-power cameras fits easily. Our PoE switch guide walks through sizing by watts.
Get it for a small camera or access-point network that you want on its own VLAN without a separate injector per device. Hold off if you need a proven track record today. The listing has single-digit reviews, and we could not confirm a management VLAN in TP-Link’s documentation for this model. The older TL-SG108PE costs the same, has the same 64 W budget on only four PoE ports, and has 1,800+ reviews. Avoid “renewed” TL-SG108PE listings described as 55 W 802.3af, because that is the older V2 spec. The TL-SG208PE is about $65 to $75, check the live price.
8. MikroTik CSS318-16G-2S+IN: best cheap VLAN switch with 10G SFP+
This is the pick when the switch has to feed a NAS or a Proxmox host faster than gigabit, and you want serious VLAN controls without a fan. It took this slot in October 2026, when the eight-port CSS610-8G-2S+IN that held it ran out of stock on Amazon and the only new listing left asked close to three times MikroTik’s $119 price.
The CSS318 pairs sixteen gigabit RJ45 ports with two SFP+ cages on a Marvell 98DX2518 switch chip, and it runs full SwOS rather than the SwOS Lite of MikroTik’s eight-port CSS610. On VLANs it outclasses everything above. SwOS supports up to 250 VLAN entries with a per-port default VLAN ID, and all four VLAN modes (disabled, optional, enabled and strict), so you can make a port drop anything outside its VLAN table. Management can be limited to one VLAN, an IP range and specific ports. It supports LACP and static LAG (16 groups of up to eight ports), RSTP, IGMP snooping, DHCP snooping with Option 82, 32 ACL rules and 10,218-byte jumbo frames. The power supply is internal on a standard IEC cord, so there is no adapter brick to lose. MikroTik rates it at 13 W maximum with passive cooling, and ServeTheHome measured 3.3 W idle and 5 W with a 10GBASE-T module fitted. Rack ears come in the box.
The trade-offs are real. Management is a plain web page: the manual documents no SSH, no HTTPS and no LLDP, and SNMP is read-only v1/v2c. There is no PoE-in and no dedicated management port either. The 10-inch form factor needs checking before you buy, because ServeTheHome found it would not fit four of the six 10-inch racks they tried, so measure your rack’s inner width first. It fits any 19-inch rack, two side by side in 1U. If you plan to run 10GBASE-T modules, note that MikroTik’s own S+RJ10 guidance says a module can reach 90 °C, and warns against running two side by side in passively cooled devices. The CSS318’s two cages sit side by side, so use a DAC cable or fibre for one of them.
Who it’s for: a homelab with one or two 10G hosts, a firewall trunk and more than eight wired devices, run by someone comfortable reading a manual. Skip it if: you want a guided UI or HTTPS on the admin page, or you only need eight ports and can wait for the CSS610-8G-2S+IN to return near its $119 price. About $140, in line with MikroTik’s $139 suggested price, on the Amazon listing.
Easy Smart vs Omada Easy Managed: which TP-Link line to buy
Buy Easy Managed (the ES-series, plus TP-Link’s new TL-SG205E and TL-SG208PE, although the table below is confirmed for the ES models only) unless the Easy Smart model is meaningfully cheaper for the port count you need. The two lines look nearly identical on Amazon, and both have a 32-VLAN ceiling. The difference is the management plane.
| Feature | Easy Smart (TL-SG105E, TL-SG108E, TL-SG116E, TL-SG1024DE) | Omada Easy Managed (ES205G, ES208G, ES216G) |
|---|---|---|
| 802.1Q VLANs | 32 | 32 |
| Management VLAN | No | Yes, one ID, active once 802.1Q is enabled |
| HTTPS admin | Not listed | Yes (HTTP or HTTPS web mode) |
| Management tools | Web UI + Windows Easy Smart Configuration Utility | Web UI, optional Omada software/hardware/cloud controller |
| QoS queues | 4 | 8 |
| LLDP | Not listed | Yes |
| On Omada compatibility list | No | ES205G, ES208G yes |
The earliest TP-Link-hosted ES installation guides are dated October 2024, and the TL-SG205E’s first firmware build is from June 2025. The Easy Managed line is new enough that review counts are still low, but it runs on the same Omada firmware that TP-Link documents in its Easy Managed switch user guide.
Access ports, trunk ports and PVID, reproduced on a Linux bridge
Every switch above exposes the same three settings per port: VLAN membership as tagged, membership as untagged, and the PVID (the VLAN that untagged incoming frames are placed into). A VLAN-filtering Linux bridge uses exactly the same model, so we built one on an Ubuntu 26.04 VM to show what each setting does. Ports p1 and p3 are access ports in VLAN 10, p2 is an access port in VLAN 20, and p4 is a trunk carrying both VLANs tagged to a router, with a host behind each access port. This is the excerpt that sets the port VLANs. The full lab script first creates the bridge ports as veth pairs into network namespaces and brings them up:
sudo ip link add sw0 type bridge vlan_filtering 1
sudo bridge vlan del dev p1 vid 1
sudo bridge vlan add dev p1 vid 10 pvid untagged
sudo bridge vlan del dev p2 vid 1
sudo bridge vlan add dev p2 vid 20 pvid untagged
sudo bridge vlan add dev p4 vid 10
sudo bridge vlan add dev p4 vid 20The access port and the trunk look like this afterwards. The trunk keeps VLAN 1 as its untagged native VLAN, and carries 10 and 20 tagged:
port vlan-id
p1 10 PVID Egress Untagged
port vlan-id
p4 1 PVID Egress Untagged
10
20With the router not forwarding yet, a host in VLAN 10 reaches its neighbour in VLAN 10 but gets nothing from VLAN 20. That is the isolation you bought the switch for. Once the router forwards between its VLAN interfaces, the same ping works with TTL 63, and that router is where your firewall rules between VLANs belong. Capturing on the router side of the trunk shows the 802.1Q tag the switch adds:
fa:0d:27:5c:ab:dc > 2e:c9:00:bf:41:14, ethertype 802.1Q (0x8100), length 102: vlan 20, p 0, ethertype IPv4 (0x0800), 10.0.20.11 > 10.0.20.1: ICMP echo request, id 2280, seq 1, length 64
2e:c9:00:bf:41:14 > fa:0d:27:5c:ab:dc, ethertype 802.1Q (0x8100), length 102: vlan 20, p 0, ethertype IPv4 (0x0800), 10.0.20.1 > 10.0.20.11: ICMP echo reply, id 2280, seq 1, length 64Now the mistake that breaks most first VLAN setups on TP-Link and NETGEAR switches, where PVID lives on a separate page from membership. We made port p2 an untagged member of VLAN 20 but left its PVID at the default of 1:
sudo bridge vlan del dev p2 vid 20
sudo bridge vlan add dev p2 vid 20 untagged
sudo bridge vlan add dev p2 vid 1 pvid untaggedThe port now sends VLAN 20 traffic out untagged, but every frame the host sends back lands in VLAN 1. The host in VLAN 20 cannot reach its own gateway:
port vlan-id
p2 1 PVID Egress Untagged
20 Egress Untagged
PING 10.0.20.1 (10.0.20.1) 56(84) bytes of data.
--- 10.0.20.1 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2078msSetting the PVID to 20 (and removing VLAN 1 from the port) restored the ping straight away. On any of these switches the rule is the same: an access port needs untagged membership and a matching PVID, and a trunk port needs tagged membership for every VLAN it carries. For the host side of a trunk, our guides to a VLAN-aware Proxmox bridge and VLAN interfaces on Ubuntu pick up where the switch config ends. If you want the same ideas in Cisco syntax, see the Cisco VLAN configuration guide.
What to check before buying a cheap managed switch for VLANs
802.1Q, not just “VLAN”. Port-based and MTU VLAN modes only isolate ports inside the switch. They cannot hand several networks to a router over one cable. Look for “802.1Q” or “tag VLAN” on the spec sheet. On TP-Link Easy Smart, switching modes erases your VLAN configuration.
A management VLAN, if any VLAN is untrusted. This matters more than any spec in the comparison table. Without one, a compromised smart plug can reach the switch’s login page. Among the budget picks, the Omada ES models, the Zyxel GS1200 v3 and MikroTik SwOS have one. TP-Link Easy Smart and NETGEAR Easy Smart do not. If you are stepping up anyway, NETGEAR’s Smart Managed Pro GS108Tv3 adds a management VLAN, STP, LACP and ACLs for around $80, though stock was down to single units when we checked.
VLAN count is rarely the constraint. 32 VLANs covers every home and most small offices. The 64 on NETGEAR and the 250 on MikroTik only matter if you number VLANs to match many subnets, or you are labbing for a certification.
Static LAG vs LACP. Most of these switches only do static link aggregation. That works, but the other end has to use a static bond mode (balance-xor on Linux, for example), because an 802.3ad/LACP bond will not form against a static LAG. Only the Zyxel GS1200 and the MikroTik speak LACP.
Firmware support and hardware version. These switches get security fixes, and the fixes only help if you apply them. TP-Link patched a clickjacking bug in the TL-SG108E and a stored XSS in the TL-SG108PE in 2026, and Zyxel patched an unauthenticated config read in the GS1200 v3. Buy the current hardware revision from an Amazon.com listing, not a third-party relist of old stock, then update the firmware before you configure anything.
2.5GbE is tempting, but read the fine print. The 2.5G managed switches are where the cheap-VLAN rules get murky. TP-Link’s Omada ES210X-M2 (eight 2.5G ports plus two 10G SFP+, fanless, 8.38 W maximum) looks like the natural successor to the ES208G. However, it is capped at 32 VLAN groups with static LAG only, its datasheet does not list a management VLAN, and its Amazon listing had no buy box when we checked. The generic Realtek-based 8×2.5G boxes around $55 to $80 are worse. MokerLink’s 2G08110GSM, for example, has a single SFP+ port, HTTP-only management with admin/admin defaults, and firmware updates by emailing support. A 2025 owner write-up on similar RTL8373 switches found untagged traffic leaking across VLANs for a second or two at boot. Our 2.5GbE and 10GbE managed switch guide covers that tier properly.
Which cheap VLAN switch to buy for your setup
Match the switch to where the untrusted devices live, then to port count, then to uplink speed:
- First VLAN switch, IoT or guest network on it: Omada ES208G, or the ES205G if five ports is enough.
- Tiny desk or AV-cabinet switch, lowest price, locked-down admin page: Zyxel GS1200-5.
- All-trusted homelab, following a tutorial step by step: TP-Link TL-SG108E.
- You want 64 VLAN IDs, or you prefer NETGEAR: GS308E v4.
- Nine to sixteen devices: TL-SG116E, or the ES216G if you need rack ears and a management VLAN.
- A 19-inch rack with lots of access ports: TL-SG1024DE.
- Cameras or access points that need power: TL-SG208PE, sized by watts.
- A 10G trunk to a NAS, Proxmox host or firewall: MikroTik CSS318-16G-2S+IN.
Whichever you pick, the router on the trunk does the actual enforcement between VLANs. If yours is still an ISP box that cannot do VLAN interfaces, pair the switch with one of the machines from our OPNsense and pfSense hardware guide.
