Question in the title. Feel free to include details, like what networks have wifi, what kinds of devices are on what, etc etc.

Right now I have 4 VLANs, each with a separate wifi SSID:

  1. Base - servers, workstation, and any trusted devices
  2. Business - work laptop, dock, and phone - enforces network and device isolation - lighter adblocking settings, so that work programs and services aren’t nerfed
  3. Isolated - visiting friends and family use this one - again, enforces network and device isolation
  4. Security - for cameras, doorbell, and other security devices - strongest security settings, isolation, and no direct internet access

Looking forward to hearing what others are doing, to see if I can improve my setup.

  • Sailing7@lemmy.ml
    1·
    9 days ago

    Imma shame myself now publicly.

    Got 3 Wifi SSIDs, one for internal, one for legacy internal (2.4 only - mostly IOT), one for guests (and my work devices)

    AP and FW are from Unifi and i made the guest wifi to be with client isolation.

    My entire internal network is one vlan and one subnet.

    I plan on fixing that, but yeah…

    I’ve got a synology nas that got its webserver ports exposed and synology photo backup ports.

    I plan on putting it similary like you, when i get time and a cheap managed switch.

    • Putting servers in a managed vlan
    • Putting my gaming pc and shady VM (because of mods and root level anti-cheat software, which i dont trust either of them even a tiny bit) into a seperate vlan
    • putting my externable reachable stuff (soon to be also a proper reverse proxy with basic and cert auth, for Homeasssitant, jellyfin, […] access without a vpn (because vpn and android auto dont work together and i use my gps tag for automations in Homeassistant)
    • putting all other internal devices that i trust, such as my phones and CCTV cams and whatnot in a vlan
    • though maybe i would split that too, because i like to keep my cameras and other iot stuff without an internet connection.

    Regarding your setup: i think it is pretty strong, only a dmz for externaly reachable stuff is missing. But the rest? Pretty decent!