Isolated network for dummies

[PCustoms]

Dipping my toes into some IoT/home automation shortly and really want to have these isolated from the rest of my network.

What's the easiest way to reduce the security risks of random made in china electronics hooked to my WiFi?

 

[WildBill]

Most modern wifi routers let you turn on a guest network that you can set access limits on. My guest network is set to let it see the internet but not access or see anything on my network. I use it for all my gadgets.

 

[shade]

Get a switch that can do Vlans.
Segment that traffic onto a separate vlan.
Use a firewall for access control out

 

[AffableCurmudgeon]

As suggested above, the guest network on your router will put your IoT devices on a separate VLAN. That will prevent them from seeing devices on your primary network.

Some routers will allow you to turn on an additional setting called Device Isolation for the guest network. That setting will prevent the devices on the same guest network from seeing each other. That is beneficial if you want the devices on the guest network to see the only Internet and nothing else.

 

[PCustoms]

Most modern wifi routers let you turn on a guest network that you can set access limits on. My guest network is set to let it see the internet but not access or see anything on my network. I use it for all my gadgets.

As suggested above, the guest network on your router will put your IoT devices on a separate VLAN. That will prevent them from seeing devices on your primary network.

Some routers will allow you to turn on an additional setting called Device Isolation for the guest network. That setting will prevent the devices on the same guest network from seeing each other. That is beneficial if you want the devices on the guest network to see the only Internet and nothing else.

This is can do.

Is it the same thing that @shade suggested? That sounded more complicated

 

[AffableCurmudgeon]

Is it the same thing that @shade suggested? That sounded more complicated

Effectively, it is the same same, however I believe his suggestion would involve buying a separate intelligent switch, manually configuring VLANs, setting up access control lists as needed, and then using access points to broadcast the separate VLANs for the devices to use. Businesses do that for greater security and management at the port level.

For us mere mortals, good, name brand consumer grade (but still secure) devices made by manufacturers that periodically update their firmware, simplify all that using the settings I mentioned.

 

[PCustoms]

I'm assuming I want to put the IoT stuff here:

 

[WildBill]

I'm assuming I want to put the IoT stuff here:

That looks correct.

 

[niget2002]

That should work.

 

[PCustoms]

Well thats easier then expected.