Segmented Home Network

Problem

Most homes and small offices run one flat network: phones, consoles, cameras, work laptops, and guests share the same lane. Parental controls, when they exist, are buried in router menus nobody wants to open at 10:47 PM. The need was practical: isolate risky or chatty devices, keep work and lab traffic sane, filter DNS aggressively, and give caregivers one-tap block/allow for device groups on a schedule.

Approach

We rebuilt around a dedicated OpenWrt router, then designed the network as zones — trusted devices, wired lab/servers, IoT, work, and guest — with firewall policy that matches how people actually live. DNS filtering sits in the path so ads and trackers don’t become a daily negotiation. Parental controls aren’t a vendor app: a simple web UI on the router blocks or allows whole device groups, with cron schedules for school nights and weekends.

What we built

• VLAN layout for trusted, lab, IoT, work, and guest traffic
• Firewall rules that isolate IoT and guest from the rest of the house
• Persistent DNS filtering with forced DNS to prevent casual bypass
• Hardened SSH access for administration
• A mobile-friendly “family Wi‑Fi control” page — block/allow by group, not by digging through MAC tables
• Scheduled bedtime rules plus manual override when plans change
• Documented switch-day checklist for access points and trunking

Outcome

A network that behaves like quiet infrastructure: segmented where it matters, understandable for non-technical adults, and documented enough that the next improvement doesn’t start from zero. The same pattern scales to a small office — work VLAN, guest VLAN, lab VLAN — without buying a corporate stack.

What we learned

Segmentation only helps if the daily interface is human. The VLAN diagram is for the builder. The one-tap UI is for the household. Document both — and migrate configs off temporary storage so a reboot doesn’t erase the week’s work.