How to Set Up a Smart Home VLAN: Isolate Your IoT Devices in 30 Minutes
Every smart home device on your network is a potential entry point for attackers. That cheap smart bulb running three-year-old firmware, the off-brand camera with a cloud server in who-knows-where, the robot vacuum that phones home to a server in China — they all share the same network as your laptop, phone, and banking apps.
A VLAN (Virtual Local Area Network) fixes this by splitting your single home network into isolated segments. Your IoT devices can reach the internet but cannot communicate with your personal devices. If a smart bulb gets compromised, the attacker is stuck on a network island with nothing else to exploit.
Setting this up sounds intimidating, but with the right router it takes about 30 minutes. Here is how to do it.
Why VLANs Matter for Smart Home Security
Let us start with a concrete scenario. Imagine a vulnerability is discovered in your smart plug's firmware. An attacker on the internet exploits it and gains control of the plug. Without network segmentation, that compromised plug can now:
- Scan your entire home network and discover every connected device
- Attempt to access shared network drives and file servers
- Intercept unencrypted traffic from other devices on the same network
- Launch attacks against your computers, phones, and tablets
- Use your network as a launching point for attacks against other targets
With a VLAN, that same compromised smart plug can see other devices on the IoT VLAN (other smart home gadgets) but is completely walled off from your personal devices. The attacker can turn your lights on and off. They cannot touch your laptop.
This is not theoretical. In 2019, the FBI specifically recommended that IoT devices be isolated on a separate network. Smart home botnets like Mirai exploited exactly this kind of lateral movement from vulnerable IoT devices to valuable targets on the same network.
What Is a VLAN, in Plain English
Think of your current home network as a single large room where every device can talk to every other device. A VLAN is like installing walls in that room to create separate spaces. Devices in one VLAN segment can only talk to devices in the same segment unless you specifically build a doorway (firewall rule) between them.
Technically, a VLAN tags network traffic with an identifier (a VLAN ID, which is just a number from 1-4094). Your router uses these tags to enforce separation. Devices on VLAN 10 cannot communicate with devices on VLAN 20 unless you create a firewall rule explicitly allowing specific traffic.
For a smart home setup, you typically create two or three VLANs:
- VLAN 1 (Default/Trusted): Your personal devices — laptops, phones, tablets, desktop computers. This is your main network.
- VLAN 10 (IoT): Smart home devices — bulbs, plugs, cameras, sensors, speakers. Internet access but no access to your trusted network.
- VLAN 20 (Guest, optional): Guest WiFi with internet access only. No access to IoT or trusted networks.
Which Routers Support VLANs
Not all consumer routers support VLANs. Here are the most popular options that do:
Ubiquiti UniFi (Recommended)
UniFi is the most popular choice for home VLAN setups, and for good reason. The UniFi Dream Machine (UDM) or Dream Router provides a router, access point, and full VLAN management in a single device starting around $180. The UniFi interface makes VLAN creation almost trivially easy — you literally click "create network," assign a VLAN ID, and you are done.
If you already have a UniFi setup, you can add VLANs without buying any new hardware. UniFi access points support multiple SSIDs mapped to different VLANs, so you can create an "IoT" WiFi network that automatically places devices on the correct VLAN.
pfSense / OPNsense
pfSense and OPNsense are free, open-source firewall/router operating systems that run on any compatible hardware (including old PCs and mini PCs like the Protectli Vault). They offer enterprise-grade VLAN and firewall capabilities with complete control over every aspect of your network.
The tradeoff is complexity. pfSense's learning curve is steeper than UniFi, but the community documentation is excellent and there are dozens of smart home VLAN tutorials specifically for pfSense. If you want maximum control and do not mind a weekend of learning, pfSense is unbeatable.
TP-Link Omada
TP-Link's Omada line is the budget-friendly alternative to UniFi. The Omada system (controller, router, access points, and managed switches) costs roughly 30-40% less than equivalent UniFi hardware while offering nearly identical VLAN functionality. The ER7206 router plus an EAP access point is a solid starting setup for under $150.
Asus with Merlin Firmware
Many Asus consumer routers can run Merlin firmware (an enhanced version of the stock firmware) that adds VLAN support. If you already own an Asus RT-AX86U, RT-AX88U, or similar model, flashing Merlin is free and adds VLAN tagging without buying new hardware. The setup is done through the router's web interface, though it is less polished than UniFi or Omada.
What About Standard Consumer Routers?
Most consumer routers from Netgear, Linksys, and Google do not support VLANs. However, many support guest networks, which provide basic isolation. If you cannot upgrade your router, putting all IoT devices on the guest network is a reasonable interim solution. It is not as configurable as a proper VLAN, but it provides the core benefit of separating IoT devices from your personal devices.
Step-by-Step VLAN Setup
The following walkthrough uses UniFi as the example since it is the most common setup, but the concepts apply to any VLAN-capable router. The specific menu names differ but the steps are the same.
Step 1: Plan Your Network Layout (5 minutes)
Before touching any settings, decide on your VLAN structure:
| VLAN | Name | VLAN ID | Subnet | WiFi SSID | Purpose |
|---|---|---|---|---|---|
| Default | Trusted | 1 | 192.168.1.0/24 | MyHome | Personal devices |
| IoT | IoT | 10 | 192.168.10.0/24 | MyHome-IoT | Smart home devices |
| Guest | Guest | 20 | 192.168.20.0/24 | MyHome-Guest | Visitors |
Write this down. You will reference it throughout the setup.
Step 2: Create the IoT VLAN (5 minutes)
- Log into your router's admin interface (for UniFi: unifi.ui.com or the local IP)
- Navigate to Settings > Networks
- Click Create New Network
- Set the name to "IoT"
- Set VLAN ID to 10
- Set the gateway/subnet to 192.168.10.1/24
- Enable DHCP server with a range of 192.168.10.100-192.168.10.254
- Set DNS to your preferred provider (1.1.1.1, 8.8.8.8, or your Pi-hole if you have one)
- Save
Repeat for a Guest VLAN if desired, using VLAN ID 20 and subnet 192.168.20.0/24.
Step 3: Create the IoT WiFi Network (5 minutes)
- Navigate to Settings > WiFi
- Click Create New WiFi Network
- Set SSID to "MyHome-IoT" (or whatever you prefer)
- Set security to WPA2 (not WPA3 — many IoT devices do not support WPA3 yet)
- Set a strong password (different from your main WiFi)
- Under Network, select the IoT VLAN you created in step 2
- Save
Important: Use WPA2, not WPA3, for the IoT network. As of 2026, many smart home devices (especially older ones and budget brands) still do not support WPA3 and will silently fail to connect. Your main network can and should use WPA3.
Step 4: Configure Firewall Rules (10 minutes)
This is the most important step. By default, VLANs on most routers can still communicate with each other. You need firewall rules to enforce isolation.
Create these rules in order (firewall rules are processed top-to-bottom, and order matters):
Rule 1: Allow established/related connections between VLANs
- Action: Accept
- Source: IoT VLAN (192.168.10.0/24)
- Destination: Trusted VLAN (192.168.1.0/24)
- States: Established, Related
This rule allows response traffic from IoT devices to reach your personal devices when your personal devices initiated the connection. For example, when you open the Hue app on your phone and send a command to a Hue bridge on the IoT VLAN, this rule allows the response to come back. Without it, you could send commands but never receive acknowledgments.
Rule 2: Block all new connections from IoT to Trusted
- Action: Drop
- Source: IoT VLAN (192.168.10.0/24)
- Destination: Trusted VLAN (192.168.1.0/24)
- States: New, Invalid
This is the core isolation rule. IoT devices cannot initiate connections to your personal devices. They can respond to connections you initiate, but they cannot reach out on their own.
Rule 3: Allow IoT to access the internet
- Action: Accept
- Source: IoT VLAN (192.168.10.0/24)
- Destination: Any (except RFC1918 private ranges)
This allows your IoT devices to reach their cloud services, receive firmware updates, and function normally. They just cannot reach anything on your local network outside their own VLAN.
Step 5: Move Your Devices (5 minutes)
Now connect your smart home devices to the new IoT WiFi network. For most devices, this means:
- Open the device's app
- Go to WiFi settings
- Switch to the IoT SSID
- Re-pair if necessary
Some devices (like Hue bridges and SmartThings hubs) connect via Ethernet. If you have a managed switch, assign their ports to VLAN 10. If you do not have a managed switch, you can either:
- Buy an inexpensive managed switch ($30-50 for a TP-Link TL-SG108E)
- Leave wired devices on the default VLAN for now and focus on WiFi devices first
Which Devices Go Where
Not every device belongs on the IoT VLAN. Here is a practical breakdown:
Put on the IoT VLAN
- Smart bulbs and light switches
- Smart plugs and power strips
- Sensors (temperature, motion, door/window)
- Robot vacuums
- Smart appliances (washer, dryer, fridge, oven)
- IP cameras (or put these on their own camera VLAN for even stricter isolation)
- Smart locks
- Thermostats
- Irrigation controllers
Keep on the Trusted VLAN
- Laptops, desktops, and tablets
- Phones
- NAS/file servers
- Printers (unless you only print from IoT devices)
- Gaming consoles (they need to communicate with your phone/tablet for many features)
Special Cases
- Smart home hubs (Home Assistant, SmartThings, Hubitat): These need to communicate with devices on the IoT VLAN AND with your phone on the Trusted VLAN. Put the hub on the IoT VLAN and create specific firewall rules to allow your trusted devices to access the hub's web interface (typically port 8123 for Home Assistant).
- Smart TVs and streaming devices: These are tricky. They are IoT devices with poor security track records, but they also need to receive casting from your phone (AirPlay, Chromecast). See the mDNS section below.
- Voice assistants (Echo, Google Home, HomePod): Similar to smart TVs — they need to discover and be controlled by your phone. Many people leave these on the trusted network for simplicity, since they are from major manufacturers with regular security updates.
Solving the mDNS/Bonjour/Casting Problem
Here is where most smart home VLAN setups hit a wall. You set up perfect isolation, move all your IoT devices to the new VLAN, and then discover that AirPlay, Chromecast, Spotify Connect, and Home Assistant device discovery all stopped working.
The reason: these services use mDNS (multicast DNS) or SSDP (Simple Service Discovery Protocol) to discover devices on the local network. Both protocols use broadcast/multicast traffic that does not cross VLAN boundaries by default. Your phone on the Trusted VLAN literally cannot see your Chromecast on the IoT VLAN because the discovery packets never cross the boundary.
The Fix: mDNS Reflector
The solution is an mDNS reflector (also called an mDNS repeater) that listens for mDNS packets on each VLAN and re-broadcasts them to the others. This allows device discovery to work across VLANs while keeping the firewall rules intact.
UniFi: Built-in. Go to Settings > Networks > Advanced and enable "Multicast DNS." That is literally all you have to do.
pfSense: Install the Avahi package from the package manager. Configure it to listen on both the Trusted and IoT interfaces. Enable the reflector mode.
OPNsense: Install the mdns-repeater plugin. Configure it to bridge your VLAN interfaces.
Asus with Merlin: Enable the mDNS reflector option in the VLAN settings (available in recent Merlin builds).
After enabling the mDNS reflector, AirPlay, Chromecast, Spotify Connect, and most other discovery-based services will work across VLANs. You still need the "established/related" firewall rule from Step 4 to allow the actual traffic to flow after discovery.
What About IGMP Proxy?
Some casting protocols (particularly older Chromecast implementations) also use IGMP for multicast group management. If Chromecast still does not work after enabling mDNS reflection, enable IGMP proxy or IGMP snooping on your router. In UniFi, this is under Settings > Networks > Advanced > IGMP Snooping.
Common Pitfalls and How to Fix Them
"My Smart Home App Cannot Find My Devices"
This is almost always an mDNS issue. Enable the mDNS reflector as described above. If it still does not work, temporarily move your phone to the IoT WiFi and try the app. If it works on the IoT network, the issue is definitely cross-VLAN discovery.
"My Device Will Not Connect to the IoT WiFi"
Check two things: First, make sure you are using WPA2, not WPA3, for the IoT network. Second, some very old or cheap IoT devices only support 2.4GHz WiFi. Make sure your IoT SSID is broadcasting on 2.4GHz (you can broadcast on both bands, but 2.4GHz must be available).
"Home Assistant Cannot Discover New Devices"
If Home Assistant is on the IoT VLAN, it should discover IoT devices natively. If it is on the Trusted VLAN (not recommended), you need mDNS reflection and may need additional firewall rules for specific discovery protocols. The simplest solution is putting Home Assistant on the IoT VLAN and creating a firewall rule to allow Trusted devices to access port 8123.
"I Lost Access to My Router"
If you accidentally locked yourself out by creating an overly aggressive firewall rule, most routers have a physical reset button that restores default settings. On UniFi, you can also hold the reset button for 10 seconds to restore network defaults without losing your entire configuration. Always test firewall rules before logging out of the admin interface.
Testing Your Setup
Once everything is configured, verify that isolation is actually working:
- From a device on the IoT VLAN (SSH into a Raspberry Pi or use a laptop temporarily connected to IoT WiFi), try to ping a device on the Trusted VLAN. It should fail (timeout or "destination unreachable").
- From a device on the Trusted VLAN (your normal phone or laptop), try to ping a device on the IoT VLAN. It should succeed (because your established/related rule allows responses).
- From a device on the IoT VLAN, try to access the internet (ping 8.8.8.8 or open a browser). It should succeed.
- Test casting: Play a video on your phone and cast it to a TV on the IoT VLAN. It should work if mDNS reflection is enabled.
- Test smart home apps: Open your smart home apps on your phone (Trusted VLAN) and verify you can still control devices on the IoT VLAN.
If any test fails, check your firewall rules in order. The most common issue is the established/related rule being missing or placed after the block rule.
Going Further
Once you have a basic IoT VLAN working, here are advanced steps to consider:
- Separate camera VLAN: IP cameras are high-risk devices that stream video data. Putting them on their own VLAN with no internet access (only local NVR access) is a strong security practice.
- DNS-based ad blocking: Point the IoT VLAN's DNS to a Pi-hole or AdGuard Home instance to block telemetry and tracking from smart home devices.
- Bandwidth limits: Set bandwidth limits on the IoT VLAN so a compromised device cannot saturate your internet connection.
- Intrusion detection: Enable IDS/IPS on your router (UniFi and pfSense both support this) to monitor for suspicious traffic patterns on the IoT VLAN.
Network segmentation is one of the highest-impact security improvements you can make to your smart home. It takes 30 minutes to set up, costs nothing if you already have a VLAN-capable router, and dramatically reduces the blast radius of any single compromised device. If you are serious about smart home security, a VLAN is not optional — it is foundational.