Smart-home networking guide · Includes a UGREEN sponsored segment in the video
Is Your IoT Network Actually Isolated?
I assumed a separate IoT Wi-Fi network kept smart-home devices away from my main network. A simple local test on my Orbi 970 setup showed otherwise.
The main takeaway
Check what the router actually isolates. A separate SSID can organize smart-home devices without stopping them from reaching your main LAN, and the right router depends on how much control you want.
Best for
Smart-home owners planning device isolation, especially before moving hubs and automations into Home Assistant.
Before you start
You need a step-by-step firewall configuration for your exact router; this article explains my findings and selection criteria.
My finding
Orbi IoT client could reach my NAS service
What matters
Enforced access rules
My planned move
ASUS BQ16 Pro
What helps
- Test local reachability instead of trusting a network label
- Choose controls that match your comfort with configuration
- Plan hub placement before migrating a large smart home
What to know
- A separate subnet alone doesn't prove firewall isolation
- Stricter rules can break local discovery and control
- Feature support varies by model and firmware
Why I finally checked the IoT network
Buying Home Assistant Green prompted a question I should have asked sooner: where should the hub live, and what could my smart-home devices reach? I was using an Orbi 970 with a separate IoT SSID. I expected that name to mean the devices were separated from my phones, computers, and NAS. Looking at the router's device list, I noticed that main-network and IoT devices were using the same address range. That was a reason to investigate, but the more useful step was checking whether an IoT client could actually reach a service on my main network.
The test that changed my assumption
I run OpenSpeedTest locally on my NAS. In the video I connected to the IoT Wi-Fi and tried opening that local service. It worked. That demonstrated reachability to the NAS-hosted service I was testing, even though the client was connected to the network I had labeled for IoT. It didn't prove every possible connection was allowed, but it was enough to show that the security boundary I expected wasn't there. My earlier networking video described this setup as isolated; this test corrects that assumption. These are findings from my setup in the August 8, 2026 video, not a claim about every Orbi model or later firmware.
A Wi-Fi name and a security boundary are different
A separate SSID gives you a distinct name and password, which can be useful for organization and compatibility. It doesn't inherently decide which local devices are reachable. Separate subnets and VLANs are ways to divide a network, while firewall or access rules determine which communication is allowed between those divisions. Even a different address range needs the right policy behind it. My goal is for trusted devices to initiate the connections they need to smart-home devices while limiting unsolicited access in the other direction. That policy still needs to preserve the replies and local services the household depends on.
Think in three levels of control
In the video I describe a progression from a separate Wi-Fi name, to device isolation, to segmentation with subnets, VLANs, and rules. Each step can give more control, but it can also need more attention. Isolating a device may interfere with a phone finding it or a hub controlling it locally. That's especially relevant with Home Assistant, where local communication is part of the reason I want to use it. I would plan those required connections first, make a small change, and test the automations and apps before moving the rest of the house.
Choose the level of complexity you want
For someone who mainly wants simple setup and coverage, I discuss consumer mesh systems such as Orbi, Deco, and eero. For more control without going all the way into a prosumer setup, I explain why I planned to use an ASUS BQ16 Pro. I was interested in its network segmentation controls and the included features discussed in the video. I also mention Omada, UniFi, Firewalla, pfSense, and OPNsense for people who want deeper configuration. These are different kinds of systems, not interchangeable boxes, and the exact equipment and rules still matter. Confirm the model's capabilities rather than assuming all products from a brand behave alike.
My Home Assistant plan at the time
I planned to move the network to the BQ16 Pro before starting the Home Assistant setup. I wanted the foundation in place before rebuilding device connections or adding automations. My intended trusted side included the NAS, computers, phones, and Home Assistant; the less trusted side included cameras, plugs, doorbells, vacuums, and other smart-home products. A hub still needs appropriate access to the devices it controls. This is the plan I described in the video, rather than a claim that the migration was finished or a set of rules everyone should copy.
What the UGREEN segment does—and doesn't—establish
The video contains a paid UGREEN NAS segment about local camera recording and storage. That segment is separate from my router-isolation finding and isn't a full hands-on NAS review. I've kept that distinction in the written article rather than turning the sponsor's feature rundown into a product verdict. For the router decision, the useful takeaway is the same: test the local access you care about and choose controls you can maintain. If a network is labeled IoT, ask what that label actually changes.
More networking guides and reviews
5 Networking Mistakes I Regret MakingI Finally Understand My Home NetworkThe Smartest Way to Upgrade to Wi-Fi 7Watch the full walkthrough