Recipe: IoT devices in a network of their own

The goal: bulbs, plugs, robot vacuums and speakers live in their own network, cannot reach your laptop or your NAS, and keep exactly as much internet as they need. IoT devices go years without an update and talk to servers you know nothing about. That is no reason not to use them, but it is a reason to keep them apart.

What you need

The Office router with VLANs role, or the VLANs block on top of another role that routes.
A list of what goes in that network, and which of those your phone has to be able to find. The second half is the hard one.

Step 1: the VLAN

The default table already has a third row, vlan30-iot on 192.168.30.1/24, with DHCP on and Isolated on. That is the starting point:

Keep your own network at the top. The first VLAN is what wired ports get when you do not list them separately.
Leave Isolated on. It produces a rule that drops new connections from this VLAN to all your other networks, with the internet as the only exception.
Decide about Internet. On is the normal case: most of these devices need a cloud to work at all. Off is for gear that genuinely only talks locally.

If one tick is too blunt, set Traffic between VLANs in Firewall & NAT to the matrix, where you tick per direction who may start connections. Note that with the matrix on, the Isolated tick is no longer used; the Internet tick still is.

Step 2: Wi-Fi for IoT

Under Wi-Fi, add a second SSID, for example IoT, and set VLAN to 30.
Tick only 2.4 GHz under Bands if your devices need it. Many cheap chipsets do not know 5 GHz and get confused by a network that broadcasts both under one name.
Choose WPA2 together with WPA3 under Security, not WPA3 alone. WPA3 only shuts older devices out.
Leave Client isolation off on this network. A hub driving its own bulbs, or one speaker talking to another, needs them to see each other.

If 802.11r fast roaming is on, be aware that some older IoT devices choke on it. The same goes for Management frame protection set to required.

Step 3: ports and the trunk

Put wired IoT gear on an access port with Untagged VLAN (pvid) 30. The port towards your switch or access point has to be a trunk with VLAN 30 ticked under VLAN membership. Add another VLAN later and the tool puts it on the existing trunks for you; remove one and it takes it off again.

Testing it

Connect your phone to the IoT SSID. You should get an address from 192.168.30.0/24.
Ping a device on your own network from that phone. That should fail.
Open a website. That should work if Internet is on, and fail if you switched it off.
Run /ip firewall filter print stats and see which counter moves: isolate vlan30-iot or vlan30-iot: no internet.

What breaks, and what to do about it

This is the real conversation about IoT. Chromecast, AirPlay, HomeKit, Sonos and printer detection find each other with mDNS (Bonjour) and SSDP. Those are multicast packets that live inside one network segment: a router does not forward them into another VLAN, and this tool has no mDNS repeater. Put the speakers in VLAN 30 and your phone in VLAN 10 and your phone stops seeing them, even with the firewall wide open. The firewall is about unicast; the question never travels that far.

Inside one VLAN multicast keeps working. The tool deliberately applies the bogon rule that drops multicast on the WAN side only, precisely so that mDNS, SSDP and friends stay alive on your LAN.

The practical choices:

Put what must be found next to the people looking. Chromecasts, speakers and printers in the network of the phones; sensors, plugs and cameras in the IoT network. That solves most of it.
Add by address. Many apps let you add a device by IP instead of picking it from a list. Give the device a fixed address and open the direction from your network to it in the matrix.
Use a hub that bridges for you. Home Assistant, a Hue bridge or a Sonos bridge sits in one VLAN and talks to its devices there; you talk to the hub.
An mDNS repeater is something you add by hand. The tool does not generate one. If you want it, arrange it on the router after pasting, in a container for instance.

Other things to watch

Does the trunk carry VLAN 30 all the way? If it stops at a switch that does not know it, the IoT SSID gets no address. The site checks tell you so.
No internet also means no time and no updates. The NTP server field for DHCP clients sits in LAN & DHCP, not in the VLAN table, so a device in a VLAN without internet has to get its clock from somewhere else.
A guest network is not an IoT network. They look alike, but visitors come and go while IoT stays. Keep them apart, if only because you want to change the guest passphrase more often.