Guides

VLAN for your smart home: a separate network for your devices

On a typical home network, everything sits on the same network: your laptop, your NAS, your smart TV, the camera, and the cheap smart plug from an online store. If one of those is insecure or hacked, it can see the rest. With VLANs, you divide that network into separate parts, without extra cables. It’s one of the best steps if you have many smart home devices.

What is a VLAN?

A VLAN is a virtual network. One physical network is split into multiple networks that cannot see each other, unless you allow it. A device belongs to one VLAN and gets its own address there. Traffic between VLANs goes through your router or firewall, and that’s where you set rules.

What do you need?

  • A router or firewall that supports VLANs (for example OPNsense, pfSense, UniFi, MikroTik). Many simple provider boxes cannot do this.
  • A managed switch that supports VLANs (802.1Q).
  • An access point that can link multiple wifi networks (SSIDs) to different VLANs.

A simple plan

Start with three or four networks:

VLAN Who Example network
10 Trusted: your own computers and phones 192.168.10.0/24
20 Smart home: lights, plugs, TV, cameras 192.168.20.0/24
30 Guests: internet only 192.168.30.0/24
40 Servers: Home Assistant, NAS, homelab 192.168.40.0/24

Check your plan with the CIDR overlap tool and calculate boundaries with the Subnet calculator.

How to approach it

  1. Create the VLANs on your router: a separate network with its own DHCP server for each VLAN.
  2. Configure the switch. The port to the router and to an access point is a trunk: it carries all VLANs (tagged). A port for one device (like a NAS) is an access port for one VLAN (untagged).
  3. Link wifi networks to VLANs. Create a separate SSID for each VLAN (for example “Home”, “Smarthome”, and “Guest”) in your access point.
  4. Configure firewall rules. Start with “everything between VLANs blocked” and add what’s needed:
    • Trusted may access Smart home and Servers (to control).
    • Smart home may access the internet, but not Trusted.
    • Guests only to the internet.
    • All VLANs may use your DNS server (like Pi-hole).
    • Home Assistant (on the servers) may access Smart home to control devices.
  5. Move devices one by one and check after each whether everything keeps working.

Where things go wrong

  • Locking yourself out: don’t configure a VLAN from a connection that you’re removing from it. Keep a cable in a port you’re not changing and save a backup of your configuration.
  • Devices can’t find each other anymore. Casting, AirPlay, and many Home Assistant integrations use broadcast (mDNS, SSDP) that doesn’t cross VLANs. Solutions: an mDNS repeater on your router, or a network card/VLAN interface for Home Assistant in the smart home VLAN.
  • Devices that should stay home: some smart devices want both cloud and local access. Test per device which rules are needed.
  • Too much at once. Start with one extra network (smart home), work that out, and then expand.

Sources and attribution

This article is written in our own words. Settings differ per brand; also check the guide for your own router or switch.