Question in the title. Feel free to include details, like what networks have wifi, what kinds of devices are on what, etc etc.
Right now I have 4 VLANs, each with a separate wifi SSID:
- Base - servers, workstation, and any trusted devices
- Business - work laptop, dock, and phone - enforces network and device isolation - lighter adblocking settings, so that work programs and services aren’t nerfed
- Isolated - visiting friends and family use this one - again, enforces network and device isolation
- Security - for cameras, doorbell, and other security devices - strongest security settings, isolation, and no direct internet access
Looking forward to hearing what others are doing, to see if I can improve my setup.
you have a good balance OP. I’d consider a DMZ if you’re planning on hosting any public services (or even services at all, check out the ffmpeg exploit that happened last week). other than that I wouldn’t recommend you get any more granular.
the more granular you get with this stuff, the more you have to go through if/when something goes wrong or otherwise doesn’t work. which is great when you have a lot of time on your hands and an obsession with networking, but starts to become a detriment when your interest and time need to be dedicated to other things.
I had a DMZ and the only thing in it was a virtualized OPNSense router that handled all the traffic restrictions in and out of the network.