How to Create a Smart Home Network VLAN for IoT Security

Let me tell you something that keeps me up at night as a software engineer: every smart home device on your network can potentially see every other device on your network. That cheap WiFi smart plug from Amazon? It can see your NAS, your laptop, your work computer with the VPN connection to your company's network. The Tuya firmware phoning home to servers in Shenzhen? It is on the same subnet as your family photos.

Most smart home devices have terrible security. They run outdated firmware, use unencrypted protocols, and many phone home to cloud servers you have no control over. The solution is not to avoid smart devices, it is to isolate them on their own network segment using VLANs. This guide walks you through setting it up, even if networking is not your primary skill.

What Is a VLAN and Why Does It Matter?

A VLAN (Virtual Local Area Network) is a logical network separation within your physical network. Think of it as creating separate networks without buying separate routers. Devices on VLAN 10 cannot directly communicate with devices on VLAN 20 unless you explicitly allow it through firewall rules.

For a smart home, this means your IoT devices (bulbs, plugs, cameras, sensors) live on an isolated network. If one of them gets compromised, the attacker is stuck on a network with nothing but other light bulbs. They cannot reach your computers, your phone, your NAS, or anything with personal data.

What You Need

Not every router supports VLANs. Here is what you need:

• A VLAN-capable router: UniFi Dream Machine (any model), pfSense/OPNsense on a mini PC, or a prosumer router like MikroTik. Most consumer routers (Netgear Nighthawk, TP-Link Archer, etc.) do NOT support VLANs. This is the biggest barrier to entry.
• A managed switch (optional but recommended): If you have wired IoT devices. A TP-Link TL-SG108E ($30) supports VLANs and is enough for most homes.
• VLAN-capable WiFi access points: UniFi APs, TP-Link Omada, or any AP that supports multiple SSIDs mapped to VLANs. Your AP needs to broadcast a separate WiFi network for IoT devices.

The Network Architecture

Here is the setup I run and recommend for most smart homes:

VLAN 30 for the server is optional but nice. It means your HA server can talk to IoT devices (via firewall rules) but is separated from your personal devices too. If you want to keep things simpler, put HA on your default VLAN and just isolate the IoT devices.

Step-by-Step: UniFi Setup

I will use UniFi as the example because it is the most common prosumer setup. The concepts translate to any VLAN-capable router.

Step 1: Create the VLAN

In the UniFi Network Controller, go to Settings, Networks, and click Create New Network. Name it "IoT" and set the VLAN ID to 20. Enable DHCP and set the subnet to 192.168.20.0/24. The gateway will automatically be 192.168.20.1.

Step 2: Create the IoT WiFi Network

Go to Settings, WiFi, and create a new WiFi network. Name it something like "SmartHome-IoT" (your devices do not care about the name). Under Advanced, assign it to the IoT network you just created. Set it to WPA2 (some IoT devices do not support WPA3).

Step 3: Configure Firewall Rules

This is the critical part. Without firewall rules, VLANs can still communicate with each other by default on some routers. You need explicit rules:

1. Block IoT to LAN: Create a rule that blocks all traffic from VLAN 20 (IoT) to VLAN 1 (your personal network). This is the isolation that protects your devices.
2. Allow IoT to Internet: Allow VLAN 20 to reach the internet. Many smart devices need cloud connectivity to function (or for initial setup, at least).
3. Allow HA to IoT: Create a rule that allows traffic from your Home Assistant server's IP to VLAN 20. This lets HA discover and control IoT devices.
4. Allow IoT to HA: Allow traffic from VLAN 20 to your HA server's IP on specific ports (8123 for the web UI, 5353 for mDNS, 1883 for MQTT). This lets devices push updates to HA.
5. Block IoT to IoT (optional): If you are paranoid (and as a security-conscious engineer, I am), you can also enable client isolation on the IoT WiFi. This prevents IoT devices from talking to each other directly, forcing all communication through HA.

Step 4: Reconnect Your IoT Devices

Now comes the tedious part. You need to reconnect every smart device to the new IoT WiFi network. For WiFi devices, this usually means resetting them and going through setup again with the new SSID. For Zigbee and Z-Wave devices that connect through a coordinator, no change is needed, they do not use WiFi.

The mDNS Problem (and How to Fix It)

Here is where most VLAN setups break: mDNS. Many smart home devices use mDNS (Multicast DNS) for discovery. When devices are on a different VLAN, mDNS broadcasts do not cross the VLAN boundary by default. This means Home Assistant cannot discover devices on the IoT VLAN automatically.

The fix is an mDNS reflector. On UniFi, enable "Multicast DNS" under Settings, Network, Global Settings. On pfSense/OPNsense, install the Avahi package which reflects mDNS across VLANs. This allows discovery to work while keeping the actual traffic isolation in place.

Dealing With Devices That Break

Some devices genuinely need to be on the same VLAN as your phone to work. Chromecast and AirPlay devices are the classic examples, they require the casting device and the receiver to be on the same network. Options:

• Put casting devices on the main VLAN: A Chromecast is a Google device that you explicitly trust. It is not a random IoT widget.
• Enable IGMP/multicast proxying: This allows casting protocols to work across VLANs without full network access. More complex to set up but technically cleaner.
• Use targeted firewall rules: Allow specific traffic types (like mDNS and SSDP) between VLANs while blocking everything else.

DNS-Level Blocking for IoT Devices

As a bonus security layer, point your IoT VLAN's DNS to a Pi-hole or AdGuard Home instance. This lets you block telemetry domains that IoT devices phone home to. You can see exactly which devices are calling home, how often, and to which servers.

When I first set this up, I was surprised to see a single smart plug making 800+ DNS requests per day to various Chinese cloud servers. On the IoT VLAN with DNS filtering, those requests are silently blocked and the plug still works locally with Home Assistant.

Is This Overkill?

Honestly? For most people with 10-20 smart devices, a simple IoT VLAN is not overkill. It is reasonable security hygiene. You lock your front door even though most burglars target other houses. Network segmentation is the digital equivalent.

What IS overkill is going full enterprise with 6 VLANs, per-device firewall rules, and 802.1X authentication for every light bulb. Start with one IoT VLAN, get comfortable with the concept, and add complexity only when you have a specific need.