A modern home can easily hold more networked devices than a small office: TVs, speakers, thermostats, light switches, cameras, doorbells, appliances and every phone and laptop in the house. On a single flat network, every one of them can reach every other one. The cheapest smart plug on the network can see the family laptop. Segmenting the network fixes that.
A practical layout
Most homes need only a handful of segments, each its own VLAN and subnet:
- Trusted for personal computers and phones;
- IoT for smart home devices, TVs and appliances;
- Cameras for cameras and doorbells, recording to a local NVR;
- Guest for visitors, with internet access only;
- Management for switches, access points and servers.
Map each Wi-Fi network name to its VLAN, and give wired ports the right VLAN at the switch, so a device lands in the right segment just by how it connects.
Firewall rules: default deny
VLANs only separate traffic; the firewall decides what may cross. Start from deny between segments, then allow only what is needed:
- trusted devices may reach IoT devices to control them, but not the other way round;
- cameras may reach the NVR and nothing else, and ideally have no internet access at all;
- guests reach the internet and nothing local;
- only trusted admin devices reach the management segment.
Keep discovery working
Many devices find each other with multicast and broadcast protocols such as mDNS, SSDP and the discovery used by casting and music systems. Those do not cross VLANs on their own, which is why segmentation is often blamed for "breaking" casting or whole-home audio. An mDNS repeater or a UDP broadcast relay on the router forwards just those discovery packets between the segments that need them, while the firewall still controls the actual connections.
The details that save time later
- Give fixed devices DHCP reservations so firewall rules and integrations can rely on their addresses.
- Keep firmware current, and put devices that no longer get updates on the most restricted segment.
- Prefer local control. Devices that work without a cloud account keep working when the vendor's service does not.
- Test each rule from a device in the segment it applies to; a rule that was never tested is only a hope.
Done once and documented, a segmented network is no harder to live with than a flat one, and far harder for one weak device to compromise.