How do I add VLANs to my existing home network?

Question

I currently am configuring my home for a HomeAssistant + Apple HomeKit setup. I have disparte devices that I want to bring together in an eco system.

One of the things that I read is that I should setup a VLAN to isolate IOT devices for better security.

I have an ISP router (that can not be in bridge mode) connected to my mesh network (setup in AP access point mode). However none of these devices allow me to setup a VLAN.

I think this is what I need from a configuration perspective:

• VLAN A - home computers, TVs, mobile phones, smart thermostat(?), Ring cameras(?)
• VLAN B - bulbs, switches, sensors etc.

How can I augment my existing hardware to add VLANs to my home network so I can isolate devices properly.

Is my thinking sound and how would I go about doing this? I don't think I want to upgrade to a new mesh network...b/c it still might not work with my ISP router for configuring a VLAN.

Do I need a device in between my ISP router and my mesh network routers?

Can it be connected this way:

1. ISP Router <-> Smart Switch
2. Smart Switch (VLAN A)<-> Orbi Mesh Router
3. Smart Switch (VLAN B)<-> Another Mesh Router(?)
4. Another Mesh Router <-> Home Assistant Green hub

So I would need to buy a Smart Switch and Another Mesh Router for IOT devices?

Can devices on (VLAN A) my Orbi Mesh Router talk to the devices on the new (VLAN B) Mesh network?

Answer 1

To add VLAN or not is depending on what threat level and the value of what you protect is, so it is a fluffy decision.

First of all a Managed Switch could be replaced with several small dumb switches, one for each VLAN.

Second you need a Firewall that can have rules for how the traffic should pass between the different VLAN. Example: The "Home Assistant Green hub" should be able to connect the IoT devices or vice versa, but the IoT devices shouldn't be allowed to connect to the LAN segment with the PC/mobiles and such.

So I would recommend a:

• Firewall with rule features
• Dumb switches for each purpose. And where there is just a AP in one "VLAN" you can connect it directly to the firewall.
• AP (Access Points) for each purpose.

There is a advantage with using VLAN and that is that some Firewalls can have virtual interfaces and then you just connect one physical cable to the firewall that contains all VLAN (aka trunk).

Answer 2

As an alternative, I would suggest that you use the guest feature of many home routers. You can put the IoT devices on the guest network and have your phone and PCs on the regular non-guest network. That can serve similar purpose of isolating traffic. i.e, ensuring that a compromised IoT device cant try to port scan or DoS your PCs or phone.
During the setup process, you may have to connect with your phone to the guest network. After that, it kind of works thru the internet. i,e, any comms between your phone and the IoT device has to happen either via the cloud infrastructure setup by the device provider or atleast get routed somewhere on the internet.
Cast type of services (Apple airplay / google cast) type of devices will need to be on the main network and this strategy of putting things on the guest network will not work for that. But light switches, etc will work, though, with a little bit of added delay (and dependence on your internet connectivity)