Home Network Security: VLANs, Guest Wi-Fi, and DNS Filtering

[ccb056]

For me, the biggest thing is not trusting IoT devices.

I run an OPNsense firewall and have separate VLANs for trusted devices, IoT, and guests. My PCs, laptops, phones, NAS, etc. are on one network, while smart TVs, streaming boxes, and other random "smart" devices get their own VLAN with internet access but very limited access to anything else.

A guest network is definitely worth having too. Mine is internet-only and can't reach anything on my internal networks. I don't want to think about whether a visitor's phone or laptop is clean.

I also run AdGuard Home. The ad blocking is nice, but honestly I like the visibility more than anything. It's surprising how much traffic some devices generate in the background. It also catches the occasional sketchy domain before a device can reach it.

For firewall rules, I try to keep things simple:

Default deny between VLANs
Only allow specific traffic that's actually needed
No inbound ports open unless I have a very good reason
VPN for remote access instead of exposing services directly

I think a lot of people spend time building complicated rulesets when basic segmentation gets you most of the benefit.

As for router/firewall updates, I install security updates pretty quickly. Consumer routers often go years without updates, which is one of the reasons I moved to OPNsense. I also periodically look through DHCP leases and connected devices just to make sure nothing unexpected shows up.

If someone asked me where to start, I'd prioritize it like this:

Keep firmware updated.
Use WPA2/WPA3 and strong passwords.
Create a guest network.
Put IoT devices on their own VLAN/network.
Add AdGuard Home or Pi-hole.
Use a VPN instead of opening ports to the internet.

In my opinion, separating IoT devices from the things that actually contain your personal data is probably the biggest security improvement most home users can make without spending much money.