Created: June 10, 2026
High-Performance Residential Network
Network Segmentation & Logic
The UniFi gateway supports 802.1Q VLANs, so segmentation is now done with real VLANs (each mapped to an SSID and/or switch ports) rather than the two-SSID workaround that Google Nest forced. This gives true isolation plus targeted firewall rules between segments.
VLAN 10: Main (Private)
- SSID:
House_Network_Name - Devices: work laptop, Plex server, NAS, personal phones, the Home Assistant gateway, trusted streamers.
- Why? These devices need to talk to each other (casting, file access) and to reach the internet.
VLAN 20: IoT
- SSID:
House_IoT(plus tagged switch ports) - Devices: Wi-Fi smart plugs, the mailbox sensor, Matter-over-Wi-Fi gear, other "cheap" IoT.
- Why? Keeps untrusted IoT off Main. Firewall rule: Home Assistant may initiate to IoT (so it can control devices), but IoT cannot initiate back to Main. This is the key fix over the old "put IoT on Guest" approach, which blocked Home Assistant from reaching those devices at all.
VLAN 30: Cameras
- Devices: gate camera, any wired/PoE cameras.
- Why? Cameras are chatty and a common attack target. They get internet only if a cloud service needs it; the NVR (UniFi Protect on the UDM-SE) and Home Assistant reach them via explicit rules.
VLAN 40: Guest (Isolated)
- SSID:
House_Guest - Devices: visitors only.
- Why? Guest gets internet and nothing else. No access to Main, IoT, Cameras, or any internal service.
Special Note: The Gate AP
Configure the TP-Link Outdoor AP at the gate to broadcast:
House_Network_Name(so your phone connects when you pick up mail).House_Guest(for visitors at the gate).House_IoT(for the mailbox sensor), with the AP's uplink trunking the VLANs.
Ensure the passwords match the house exactly for seamless roaming.
Security Considerations
- Guest gets internet only; no path to internal resources.
- IoT is isolated from Main; Home Assistant reaches IoT one-way via an allow rule.
- Cameras are isolated; only the NVR and Home Assistant can reach their streams.
- Work laptop and server infrastructure are isolated from guest and IoT traffic.
- NetAlertX can now scan the IoT, Camera, and Guest VLANs from the wired core, which was impossible behind Nest's client-isolated guest network.
- Firmware and device management are handled in the UniFi controller (auto-update or scheduled maintenance windows).