12.3 Smart Home Segmentation and Guest Network Ideas
A Flat LAN Is a Flat Trust Map
On one subnet, every host trusts the L2 broadcast domain: ARP answers from anyone, and mDNS/SSDP discovery chatter lets any device enumerate its neighbors -- a bulb hub happily announcing "camera on 192.168.1.40, RTSP open." Once an attacker owns that camera through a firmware bug, nothing stops it from port-scanning the workstation's SMB 445 and RDP 3389 or hammering NAS credentials. The QA-style answer matters mechanically: an IoT node on the workstation's segment is a pre-positioned pivot, because the only thing between a never-patched webcam and your files was a shared network with no rules.
VLANs and the Deny Rule
Segmentation answers with 802.1Q: tagged VLANs split switch ports and SSIDs, and inter-VLAN routing on a real firewall (a router-with-ACLs or an OPNsense box) replaces the flat bridge. The load-bearing rule is asymmetric: drop all traffic originated by the IoT subnet toward the trusted subnet -- new connections and, critically, do not let IoT replies ride "established" state the other direction -- while permitting trusted hosts to open sessions to IoT devices so your phone can still view the camera. One direction allowed, the other denied, is the whole lateral-movement story.
The Minimum Allow-List
Beyond that, IoT needs almost nothing: DHCP (served locally per VLAN), DNS, and NTP for time, which many firmwares silently require. Anything more -- arbitrary TCP/UDP to the WAN included -- is a feature you can afford to lose; some homes block IoT outbound entirely except update windows. Test the walls, don't hope: run nmap from an IoT-VLAN host and verify the trusted range is filtered, and remember IPv6 gets its own firewall rules.
Guest SSIDs and Operational Gotchas
When managed switches are out of reach, a guest SSID with client isolation is the poor-man's VLAN: put your own IoT on it too, not just visitors. Expect breakage: AirPlay/Chromecast and hub pairing rely on mDNS, so use a controlled reflector rather than opening the wall. Keep printers/NAS pulls initiated from the trusted side, and re-audit after firmware updates re-enable hidden services.
Architecture Diagram
Key Takeaways
- A shared subnet converts any compromised IoT node into a recon-and-pivot platform against your real machines.
- 802.1Q VLANs plus firewall inter-VLAN routing replace implicit trust with explicit, testable rules.
- The core rule is asymmetric: allow trusted-to-IoT sessions, default-deny all IoT-initiated traffic to LAN subnets.
- IoT realistically needs only DHCP, DNS, and NTP; block everything else first and open exceptions case by case.
- Verify with nmap from inside the IoT VLAN, firewall IPv6 separately, and expect mDNS-dependent devices to need a reflector, not a hole.