You decided to set up a dedicated network for your smart home devices. You want it separate from your main network for security, but functional enough that your smart home actually works. In 2026, the best-practice setup looks different than it did a few years ago, primarily because of Matter and the newer mesh Wi-Fi systems. Here is the recommended approach.
Why dedicated IoT network
A dedicated network for smart home devices provides:
- Security isolation (compromised IoT devices cannot reach your computers)
- Predictable channel and band (no contention with your laptops)
- Simpler troubleshooting (you know which devices are on which network)
- Compliance with security guidance from CISA and similar
The cost: complexity. Setup takes longer and requires understanding networking.
Pick your router
Your router determines what is possible. Capable routers in 2026:
- Unifi UDM-Pro or UDR: most flexible, requires technical comfort
- OPNsense or pfSense on dedicated hardware: maximum flexibility, steepest learning curve
- Mikrotik: powerful, terse interface
- Asus ZenWifi with proper VLAN support: consumer-friendly, mostly capable
- Eero: simpler but more limited; basic IoT separation only
If you have no networking background, start with Eero or Asus. Move to Unifi if you outgrow them.
Plan your subnets
For a typical smart home:
- Main (192.168.1.0/24): laptops, phones, tablets, file servers
- IoT (192.168.30.0/24): smart bulbs, plugs, sensors, voice assistants
- Guest (192.168.50.0/24): visitor devices
- Cameras (192.168.40.0/24): security cameras, baby monitors (optional separation)
Each subnet has its own SSID. Devices are placed by purpose.
Wi-Fi configuration per subnet
Main: WPA3 only, 2.4 GHz and 5 GHz and 6 GHz (if available), band steering enabled. Optimized for performance.
IoT: WPA2 only (for IoT compatibility), 2.4 GHz only, no band steering, fixed channel. Optimized for compatibility and stability.
Guest: WPA2, all bands, client isolation enabled.
Cameras: WPA2 or WPA3, 5 GHz preferred for bandwidth, no band steering.
Firewall rules
The default for cross-subnet traffic is deny. Add explicit allows for what you need:
- Main can initiate connections to IoT (for control)
- IoT cannot initiate connections to Main (security)
- All subnets can reach the internet (for cloud features)
- Guest cannot reach any internal subnet
- Cameras can reach manufacturer cloud only, blocked from other internal subnets
Stateful inspection allows return traffic without explicit rules.
mDNS reflection
For smart home discovery, enable mDNS reflection between Main and IoT subnets. Direction: both ways usually.
Without this, your phone on Main cannot discover devices on IoT, breaking Apple Home, Matter, Cast, AirPlay, etc.
DHCP reservations
Reserve specific IPs for important devices:
- Your hub (Hue Bridge, Hubitat, etc): always at 192.168.30.10
- Your home hub (HomePod, Apple TV): 192.168.30.20
- Your printer: 192.168.30.30
Predictable IPs make troubleshooting easier and prevent IP changes from breaking integrations.
DNS configuration
Set custom DNS for the IoT subnet. Options:
- 1.1.1.1 (Cloudflare): fast, no logging
- 8.8.8.8 (Google): fast, logs queries
- Pi-hole on your network: blocks ads and tracking from IoT devices
Pi-hole is particularly useful for IoT because many IoT devices ping manufacturer telemetry servers constantly. Blocking these reduces traffic and improves privacy.
Per-device blocking
Some IoT devices have known-bad behavior (constant cloud telemetry, attempts to reach unrelated servers). Block these at the firewall.
Use traffic logs from your firewall to identify what each device is doing. Block what is not needed for legitimate function.
VPN for remote access
Do not expose your home network to the internet through port forwards. Use a VPN (WireGuard, Tailscale, ZeroTier) for remote access.
Tailscale is the easiest to set up. WireGuard is more performant. ZeroTier offers similar features. Pick one and stick with it.
Thread border router placement
If you use Thread devices, place a Thread border router (HomePod Mini, Apple TV 4K from 2022, Nest Hub 2nd gen, eero) on the IoT subnet. Thread runs on a separate radio, but the border router needs to be reachable from the Main subnet for control.
With mDNS reflection between Main and IoT, the border router is reachable. Thread itself does not cross VLAN boundaries; it has its own mesh.
Matter controller placement
Matter controllers (HomePod, Echo, Nest Hub, Google Home) live on the IoT subnet with the devices they control. Phones on the Main subnet control through mDNS-reflected discovery.
Multi-fabric Matter (commissioning a device to multiple ecosystems) works as expected when both controllers are on the IoT subnet and reachable through mDNS reflection.
The backup hub
For safety-critical automations, run a backup hub. If your primary HomePod fails, an Apple TV picks up. If your Hue Bridge fails, a secondary bridge takes over.
Backup is more important than RAID for smart homes because the failure modes are more visible to users.
Monitoring
Set up basic network monitoring:
- Logs of DHCP assignments (so you can see new devices joining)
- Bandwidth use by device (identifies bandwidth hogs)
- Connection attempts to blocked destinations (catches malware)
Unifi and OPNsense both have built-in monitoring. Consumer routers vary.
UPS for hub and router
Brief power outages affect networking before they affect anything else. A UPS on your router and hub keeps things running through blips and gives you time to gracefully shutdown for longer outages.
Document everything
Write down your network topology, subnet assignments, key IPs, and key firewall rules. When something breaks 6 months from now, you will not remember why it was set up the way it was.
Test the full flow
After setup:
- Voice command from a phone on Main reaches an IoT device
- Cast or AirPlay from Main to an IoT speaker
- Camera live view from Main to a Cameras-subnet camera
- VPN access from outside the home
- Verify isolation: IoT cannot reach Main computers
Each verifies a different aspect. All should work after proper setup.
The maintenance routine for a working network
A working IoT network needs about thirty minutes of attention per quarter. Update router firmware, review the device list and remove anything no longer in use, scan for any new neighbor Wi-Fi interference, verify mDNS reflection still works. The investment pays back in stability.
This is a small habit that prevents the slow decay that affects most home networks. The wider topic of operational maintenance is in our mesh maintenance guide.
The pet-camera footprint to plan for
Households with pet cameras (Wyze, Ring, Nest) discover that the cameras dominate IoT network bandwidth, especially during pet-active periods. Provision the IoT network for camera bitrate as a primary constraint. A 1080p camera at high quality uses 4-6 Mbps; multiply by however many cameras you have. The broader network capacity planning is in our channel selection guide.
