Set Up a Guest Network to Isolate Smart Home Devices

The Problem

A typical home network treats every device as equally trusted. Your work laptop, your NAS full of family photos, and a £12 smart plug running firmware from 2019 that will never be updated all sit on the same flat network, able to talk to each other freely.

That matters because cheap IoT devices are the weakest link by a wide margin. They ship with hardcoded credentials, stop receiving updates quickly, and often phone home to servers you cannot inspect. If one is compromised, it does not just misbehave on its own — it becomes a foothold on your network with a clear view of everything else.

The fix is segmentation: put untrusted devices somewhere they can reach the internet but not your computers. On most home routers, the guest network does this in about ten minutes.

Router still on its default admin password? Do secure your home Wi-Fi router first. Segmentation is pointless if the router itself is open.

What Goes Where

| Network | Devices | |---|---| | Main | PCs, laptops, phones, tablets, NAS, printer (if you print from PCs) | | IoT / guest | Smart plugs, bulbs, cameras, doorbells, robot vacuums, smart TVs, speakers, thermostats | | Guest (visitors) | Anything belonging to someone else |

The rule of thumb: if the device receives regular security updates and you would be comfortable typing a password on it, it belongs on the main network. Everything else goes on the isolated one.

The Fix: Step-by-Step

Step 1: Find Out What Your Router Can Do

Sign in to the router — usually 192.168.0.1 or 192.168.1.1, or the address printed on the label. Look for these features:

Guest network — a second Wi-Fi name, usually with client isolation.
AP isolation / client isolation — stops devices on that network talking to each other.
IoT network — some newer routers offer a dedicated one, which is the same idea with a better name.
VLAN support — proper segmentation, on prosumer and mesh systems.

If your router has none of these, that is a genuine reason to replace it. Any current router from a mainstream brand includes at least a guest network.

Step 2: Create the Isolated Network

Find Guest Network in the router settings, often under Wireless or Wi-Fi.
Enable it and give it a distinct name — HomeIoT rather than Home-Guest, so you can tell them apart.
Set WPA2 or WPA3 with a strong, unique password. Never leave it open.
Enable Allow guests to access local network = Off. This setting is the entire point; the wording varies (Isolate, Access Intranet, AP Isolation).
If offered, cap the bandwidth modestly — cameras uploading constantly can saturate an upload link.

Step 3: Check Whether 2.4 GHz Is Available on It

Most IoT devices are 2.4 GHz only and many refuse to join a network where 2.4 and 5 GHz share one name.

If the guest network is 5 GHz only, either enable a 2.4 GHz guest band or split the bands so you have a distinct 2.4 GHz name for setup. Some devices also need your phone to be on the same 2.4 GHz band during pairing — a common cause of "the app cannot find my device."

Step 4: Move Devices Over, One Category at a Time

Do not do all of them in an evening. Work through in this order, testing as you go:

Bulbs and plugs — simplest, least disruptive.
Cameras and doorbells — see secure smart home cameras while you are in each app.
TVs and streaming sticks.
Speakers and displays.
Vacuums, thermostats, and everything else.

Each usually means opening the device's app, choosing "change Wi-Fi network", and re-pairing. Some require a factory reset of the device — check before you start with anything holding a configuration you would rather not rebuild.

Step 5: Fix What Breaks: Casting and Discovery

Segmentation deliberately breaks device discovery, and discovery is how casting works. Expect these:

Chromecast / AirPlay / Google Home / Alexa control stops working when the phone is on the main network and the device is on the IoT one.
Printers disappear from PCs if you moved the printer.
Smart TV apps that stream from your NAS lose access.

Options, in order of preference:

Keep the device on the main network if it genuinely needs to talk to your PCs. A printer used from laptops is a reasonable exception; a robot vacuum is not.
Use the cloud path — most smart-home apps work through the vendor's cloud, so control works from anywhere, including a phone on a different network.
Put your phone on the IoT network temporarily when you need direct casting.
Enable mDNS relay / IGMP proxy on the router if it has one — this passes discovery between networks while keeping general traffic separated. Mesh systems from Ubiquiti, ASUS, and TP-Link often support it.

Step 6: Use a Real VLAN If Your Hardware Supports It

A guest network is a coarse tool: one isolated zone with no rules. If you have a router or mesh system supporting VLANs — UniFi, OPNsense, ASUS with Guest Network Pro, TP-Link Omada — you can do better:

VLAN 10 – Trusted: PCs, phones, NAS.
VLAN 20 – IoT: internet only, no access to other VLANs.
VLAN 30 – Guest: internet only, isolated from everything including each other.
Firewall rules allowing trusted → IoT (so you can control devices) but not IoT → trusted.

That one-way rule is the ideal arrangement: you can reach your camera, your camera cannot reach your laptop.

Step 7: Add DNS Filtering on Top

Give the IoT network a filtering resolver so compromised devices cannot reach known-malicious hosts, and so you can see what they are contacting. Setup in set up DNS filtering to block malicious sites.

Many IoT devices hardcode 8.8.8.8, so also consider blocking outbound port 53 from that network at the router if the option exists.

Step 8: Verify the Isolation Actually Works

Do not assume the checkbox did what it says.

Connect a laptop to the IoT network.
From it, try to reach a device on the main network: ping 192.168.1.50, or open \\NAS in Explorer.
It should fail. If it succeeds, isolation is not enabled, or the two networks share a subnet.
Then confirm the reverse works if you configured it that way — from the main network, your camera app should still function.

Step 9: Audit What Is Connected Every Few Months

In the router's Attached devices or Client list, review everything. Anything you cannot identify by name and MAC deserves investigation — see find out what is using your bandwidth for the same list from the traffic side.

Remove devices you no longer own, and change the IoT Wi-Fi password when you dispose of a device you cannot factory reset.

What Not to Do

Do not leave the guest network open with no password because "it is only for gadgets." An open network is usable from the street.
Do not put your NAS or printer on the IoT network if you access them from PCs. Segmentation should follow trust, not device category.
Do not assume "guest network" means isolated. Several routers ship with local-network access enabled on the guest SSID by default. Verify with Step 8.
Do not use the guest network for your work laptop. Isolation cuts both ways — you lose access to your own printers and shares.

FAQ

Is a guest network really as good as a VLAN?

For a home, close enough. A guest network gives you the main benefit — untrusted devices cannot reach your computers. VLANs add per-zone firewall rules, one-way access, and multiple zones, which matters more as the number of devices grows or if you work from home.

Will my smart home app still work from outside the house?

Yes. Almost all consumer smart-home platforms route control through the vendor's cloud, so your phone talks to the cloud and the cloud talks to the device. Local-only systems like Home Assistant need an mDNS relay or a firewall rule instead.

Why can't my phone find the smart plug during setup?

Pairing usually requires the phone and the device to be on the same 2.4 GHz network temporarily. Join your phone to the IoT network during setup, complete pairing, then switch your phone back.

Do smart TVs belong on the IoT network?

Yes. Smart TVs run outdated Android builds, collect substantial viewing data, and rarely get long-term security updates. The exception is if you stream from a NAS on your main network — in that case, either keep the TV on main or use an mDNS relay.

Does this protect me if a device is already compromised?

It contains it. A compromised camera on an isolated network can still be used against its own vendor's cloud or added to a botnet, but it cannot scan your PCs, reach your NAS, or attack your router's admin page from inside. That containment is the point.

My router has no guest network option. What now?

Check for a firmware update first — the feature is sometimes added later. If it genuinely lacks one, an inexpensive current router will have it, and replacing a router that old is worthwhile for the security fixes alone.

Still Not Working?

If devices on the isolated network cannot reach the internet at all, check that the guest network has DHCP enabled and is not restricted to a schedule. If isolation testing shows the networks can still see each other, look for a "guest access to local network" toggle that is on, or a router that places guests on the same subnet — some cheap models label an SSID as guest without isolating anything.