How to keep smart devices off your main network

A smart camera is a computer. So is a smart TV, a video doorbell, and a Wi-Fi thermostat. Industry shorthand for these gadgets is IoT devices. Most of them were built to be cheap and easy to set up, not to be secure.

Why these devices are a real risk

Many smart devices ship with weak default passwords. Some never receive a security update again after the day they were made. A few report their video or audio to servers you did not choose and cannot see.

None of that would matter much if a hacked camera could only misbehave on its own. The real danger is what it can reach. If your camera sits on the same network as your laptop, a hacked camera can try to reach that laptop directly. It can scan for your file shares. It can sit quietly and listen to other traffic.

• A hacked camera on the same network as your laptop can try to attack the laptop directly.
• A hacked doorbell can be used to watch for when you are home or away.
• A single weak device can become the way in for an attacker who has no interest in the device itself.

The fix is not to distrust every smart device you own. The fix is to put them somewhere that limits what a hacked one can reach.

The fix: a separate network, on purpose

A VLAN lets you split one physical network into several separate ones, without running new cables. Put every camera, TV, and smart-home gadget on its own VLAN, and it can no longer see your laptop, your phone, or your file server at all, even though everything still shares the same box and the same Wi-Fi access point.

This is the same idea hotels and cafes use for guest Wi-Fi, applied to your own devices instead of visitors. The devices still work exactly as before. They still reach the internet, still connect to their apps, still record and stream. They just cannot reach anything else on your network, and nothing else on your network can reach them either.

Step by step

1. List what you actually have

Walk through your home or office and list every device that is not a laptop, phone, or server. Cameras, doorbells, smart plugs, TVs, thermostats, and game consoles all belong on this list.

2. Create a separate VLAN for them

Give this group its own VLAN and its own address range. One VLAN is usually enough for all of them, unless you have a specific reason to split cameras from everything else.

3. Move the devices onto it

Most smart devices join whichever Wi-Fi network you point them at during setup. Create a separate Wi-Fi name for the IoT VLAN, and connect each device to that name instead of your main one. Wired devices, like a wired camera, get moved by plugging them into a switch port assigned to that VLAN.

4. Block it from reaching your main devices

By default, a new VLAN should not be able to reach your main network at all. Firecradle starts every new VLAN this way, so you are blocking by default rather than remembering to add a rule later.

5. Allow only what genuinely needs to cross

Some setups need one exception. A phone app that controls your cameras from your main Wi-Fi, for example, needs to reach the camera VLAN. Add that one allowed path, and nothing else.

What still works exactly as before

Moving a device onto its own VLAN worries people because it sounds like it might break something. In practice, very little changes from the device's own point of view.

• The camera still connects to the internet and still reaches its own app or cloud service.
• A smart plug still responds to a voice assistant, as long as the assistant itself is allowed to reach that VLAN.
• Firmware updates still arrive normally, since they come from the internet, not from your main network.

The only thing that changes is what the device can reach on your own network, which was never something it needed in the first place.

Doing this with Firecradle

Firecradle ships a guided IoT isolation setup that does the steps above for you: create the VLAN, hand out addresses for it, and block it from your main network by default. You add exceptions only where you choose to.