Why separate
A cheap smart bulb or camera may have security flaws. If it sits on the same network as the computer with your accounts, an attacker can use it to get further. In a separate VLAN with firewall rules, that cannot happen.
Example setup
| Network | What belongs there | Access |
|---|---|---|
| Main | computers, phones, NAS | full |
| Guests | visitors | internet only |
| IoT | smart devices | internet and Home Assistant only |
| Cameras | IP cameras, recorder | no internet, only from the main network |
Wi-Fi
Each VLAN can have its own Wi-Fi name. Guests connect to “Guests” and cannot reach your files. I set this up as part of my Networks and Wi-Fi service.