Securing your home network

Why

This one is off-topic for this blog: no SAP, just the network at home. Most homes now have a dozen connected devices: robot vacuum, TV, cameras, alarm, doorbell.

They usually share the Wi-Fi with our phones and the laptop we work on. We cannot see their code, we cannot patch them, and manufacturers often stop updating them after a few years.

Meanwhile, vulnerabilities are found faster. In late 2024, Google reported that its AI agent Big Sleep had found an exploitable flaw in SQLite, one of the most widely used software libraries (Project Zero). In July 2025, the same tool found a flaw that attackers were preparing to exploit (The Record). Attackers have access to the same kind of tools. Waiting for manufacturers to fix things is not a plan.

If you work from home with access to client systems, a compromised TV on the same network as your work laptop is a risk for client data too.

Separating these devices takes a few hours with reasonably recent equipment. The steps below describe how, along with the problems that tend to come up.

The principle

Split your devices into two groups, each on its own network, with the router's firewall in between.

• Trusted: phones, laptops, a NAS. Anything you log in with, work on or store data on.
• IoT: everything else. Vacuum, TV, cameras, alarm, doorbell, smart plugs. They need the internet and their manufacturer's cloud, nothing more.

Both groups reach the internet. The firewall stops the IoT network from reaching the trusted one. If a device is compromised, through a bug, a leaked account password or a breach at the manufacturer, the attacker stays in the IoT network.

In SAP security terms, this is least privilege for a network. A vacuum needs its manufacturer's cloud. It has no reason to see your laptop.

One rule follows: phones and laptops never join the IoT Wi-Fi, not even to cast to the TV.

Steps

Menus differ between brands, so these steps say what to do, not where to click. Pick a time when nobody needs the internet.

1. Make an inventory. List every connected device and put it in one of the two groups. Note which are wired and which use Wi-Fi. Unplug what you no longer use.

2. Check your equipment. You need:

   • a router that supports several internal networks (VLANs) and firewall rules between them;
   • access points that can link a Wi-Fi network (SSID) to a VLAN;
   • if there is a switch between the router and the access points, a managed switch with 802.1Q VLAN support.

   Most internet provider boxes cannot do this. If yours cannot, go to the section on equipment without VLANs.

3. Update the firmware, router first, since it faces the internet. Back up its configuration, connect by cable and check the hardware version before downloading. Read the release notes: some upgrades need an intermediate version first.

4. Create the IoT network on the router: a VLAN with its own address range and DHCP. Block traffic from the IoT network to the trusted network, with an isolation option or a firewall rule. A filtering DNS resolver on that network is a useful extra.

5. Create the IoT Wi-Fi on the access points, linked to the IoT VLAN, with its own password. Use 2.4 GHz; most connected devices do not support 5 GHz. Leave the main Wi-Fi as it is. Use the same name and password on every access point.

6. Configure the switch, if there is one. Ports to the router and the access points carry both networks: main untagged, IoT tagged. A port with a single IoT device behind it, such as a TV or an alarm, gets the IoT network untagged and its default VLAN (PVID) set to the IoT VLAN. Leave the other ports alone.

7. Test before moving anything. Connect a phone to the IoT Wi-Fi. It should get an address in the new range and reach the internet, but not the router's admin page, your laptop, your NAS, the switch or the access points. Then disconnect it.

8. Move the devices one at a time. Some apps have a "change Wi-Fi network" option. Others need a Wi-Fi reset on the device, usually a button combination from the manual. Avoid a full factory reset, which erases settings. Wired devices only need their cable unplugged and plugged back in. After each move, check that the device shows up in the new address range.

9. Harden what you manage. Change default admin passwords. On switches and access points, turn off Telnet, plain HTTP and SNMP if unused. Turn off remote management from the internet and avoid port forwarding. Use the router's VPN for outside access.

10. Secure the manufacturer accounts with a unique password and multi-factor authentication. The manufacturer's cloud is a more likely way in than your network.

11. Document and back up. Export each device's configuration, note which switch port goes where (in the port descriptions too), and keep admin passwords in a password manager.

Pitfalls

• PVID. Setting a switch port to "untagged" in the IoT network only covers traffic going out to the device. The PVID decides where traffic coming from the device goes. Leave it unchanged and the switch can reach the device but drops everything it sends back. Some switches set the PVID automatically, many do not.
• Tagged or untagged. A TV or an alarm does not understand VLAN tags, so its port must be untagged in the IoT network. Only links to the router, switches and access points are tagged.
• Equipment locked to an old controller. A switch once adopted by a management application can keep its own web page locked after that application is gone. The only way back is often a factory reset. Check before you start.
• VLAN number already taken. Some internet connections use a VLAN number internally, and the router may refuse it without a clear message. Pick another number.
• Casting and discovery stop working. Phones on the main network no longer see the TV, speaker or printer on the IoT network. Decide per device: live with it, keep that device on the main network, or open a specific rule.
• Wi-Fi resets are not obvious. Sync buttons can hide under covers, and holding a button too long can trigger a factory reset. Read the manual first and have the app open, since some devices time out after a few minutes.
• Isolation only covers internal networks. Anything reachable through a route on the internet side, such as a modem's admin page or a backup line, is still reachable from the IoT network. Block it with an explicit rule.
• Devices take their time. A wired device keeps its old address until its link drops, and an alarm can take several minutes to show up. Old entries stay in the router's client list until their lease expires.

Without VLAN support

Most homes can still cut the risk a lot with what they have.

• Put connected devices on the guest network, and check that it cannot reach the main network. Weaker than a VLAN, much better than one shared network.
• Keep the router updated, automatically if possible. Replace a router that no longer gets updates.
• Change the router's default admin password. Turn off remote administration, UPnP and WPS.
• Use WPA2 (AES) or WPA3. Turn off the older WPA and TKIP modes.
• Give each manufacturer account a unique password and multi-factor authentication.
• Turn on automatic updates in each device's app.
• Unplug old devices and turn off features you never use, such as remote video viewing.
• Before buying, check how long the manufacturer promises security updates.

Conclusion

Network separation does not replace updates, a password manager and multi-factor authentication on your own devices. It limits the damage when a device you do not control fails, whatever its manufacturer does.

Count a few hours, most of them on the pitfalls above. Afterwards the vacuum, the TV and the cameras still work, and they cannot reach anything else.