Most of the gadgets in my house talk to a company’s cloud. A thermostat, a doorbell, a baby monitor. I trust them to do their job. I don’t trust them to sit on the same network as my laptop and my server.
So I gave them a network of their own. This is how it went, and the parts that surprised me. It builds on My Developer Setup, which covers the rest of the house.
The idea
I wanted three networks with simple rules:
- lan is the trusted one. My computers, the server, my phone and the things that need to talk to each other.
- guest is for visitors. Internet only.
- iot is for the cloud gadgets. Internet and DNS, and nothing else.
The rule that matters is about who can start a connection. My trusted network can reach into iot, so Home Assistant and my phone can still control everything. The other direction is closed. A gadget can answer me, but it can’t start a conversation with anything on lan.
| From | To the internet | To lan | To iot |
|---|---|---|---|
| lan | Yes | Yes | Yes |
| guest | Yes | No | No |
| iot | Yes | No, with a few narrow exceptions | Yes |
Names first
Before adding anything, I renamed what I already had. The old setup had a mix of capitalized zone names and leftover defaults, and I kept misreading them. Everything is lowercase now and matches: the interface, the firewall zone and the Wi-Fi entry all share one name per network. It took a few seconds per step and saved me from several mistakes later.
DNS is the quiet half of the job
Isolation doesn’t help much if the gadgets can look things up wherever they like. My network blocks ads and trackers with Pi-hole, so I wanted every device to use it.
- iot devices are told to use Pi-hole. If one has a hardcoded public DNS server, the router quietly redirects the request to Pi-hole anyway, and DNS over TLS is blocked so a device can’t tunnel around it.
- guest devices ask the router, and the router asks Pi-hole first, with a public resolver only as a fallback if Pi-hole is down. Pi-hole sees guest lookups as coming from the router, so it doesn’t keep a per device log of my visitors.
One gotcha cost me a bad few minutes. Pi-hole has a setting for which networks it answers. If it’s left on a local only mode, devices on iot get no DNS at all and look like they’ve lost internet. I pinned the setting in the container’s config so a click in the web interface can’t undo it.
Finding things across networks
Smart home gadgets find each other with mDNS, which doesn’t cross between networks by default. Without help, Home Assistant and Apple Home can’t see anything I moved. The fix is a reflector on the router that repeats mDNS between lan and iot, and only those two. Guest stays invisible to everything.
What I moved, and what I left behind
I moved the cloud gadgets one at a time and checked each one before the next. The ones tied to a baby’s sleep waited for daytime, because a gadget that needs setting up again in its app is better handled when nobody is trying to sleep.
A few things stayed on lan on purpose:
- Anything that uses Matter. Matter leans on IPv6, and my iot network doesn’t have it. I moved a Matter light over, watched it fall off the network, and moved it back.
- Game consoles and a VR headset. The iot Wi-Fi is 2.4 GHz only, which is too slow for game downloads and streaming. Remote play and casting also depend on finding the other device on the local network, and that discovery doesn’t cross.
Making it safe to try
I ran the changes as a script from my laptop, one phase at a time: rename, DNS, then iot. Each phase checks the router first, refuses to run out of order, and validates the firewall before reloading it. I saved a restore point before the first change and another after each phase, so any step could be undone with one command.
This turned out to matter less than I feared. On this version of OpenWrt a Wi-Fi change only restarts the networks whose settings changed, so my laptop didn’t even notice the rename. But I was glad to have the restore points.
What I would change
- Turn on client isolation for guest Wi-Fi, so one visitor’s phone can’t reach another’s.
- Plan for IPv6 on iot earlier, since more Matter gadgets will show up.
- Write down which device is which before starting. Four of mine had no name, and I identified them by checking what each one looked up in Pi-hole’s logs.
If you’re starting out
- Rename things consistently first. It’s cheap and it pays off.
- Make the new network’s DNS go through Pi-hole, and check Pi-hole actually answers on it.
- Reflect mDNS between your trusted network and iot, and nowhere else.
- Move one device at a time, and keep a restore point you can reach without the network you’re changing.