Why my home has eight networks instead of one

A while back I was scrolling through the traffic logs on my firewall — a thing that sounds more exciting than it is — and I noticed a little smart plug, the cheap kind that just turns a lamp on and off, quietly trying to talk to a server on the other side of the world. Not to its manufacturer. Somewhere else. It had no reason to do that. It has one job.

I'll never know for sure whether it was compromised, phoning home for some boring reason, or just written badly. But it doesn't really matter, because the question it left me with is the one that counts: if that plug were up to something, what else in my house could it reach?

On most home networks, the answer is everything.

One password, one big room

Here's how a normal house is wired. Internet comes in, you plug in a router, and every device — laptops, phones, the TV, the doorbell, the kids' tablets, that smart plug — joins the same Wi‑Fi with the same password. It's simple. I did it that way for years.

The catch is that “same network” means “allowed to talk to each other.” Your work laptop and a twelve-dollar plug from a company you've never heard of are standing in the same room, and nothing stops the plug from knocking on the laptop's door. Most of the time nothing knocks. But security isn't about most of the time. It's about the one device that turns out to be weak, and how far the trouble spreads when it does.

I think of it as blast radius. On a flat network, the blast radius of any single bad device is the whole house.

Fire doors, not one big room

The fix isn't to go buy more secure gadgets. You can't, really — you don't control how they're built. The fix is to stop keeping them all in the same room.

So instead of one network, I run eight. Each one is its own island. Devices on an island can talk among themselves, but they can't wander over to another island unless I've specifically allowed it. It's the watertight-compartment trick from ships: a leak in one doesn't sink the boat. Or fire doors in a building — the fire still happens, it just doesn't take the whole floor with it.

Eight sounds like a lot. It's less fiddly than it sounds, because the islands mostly sort themselves out once you ask one question of each group of devices: if this got taken over, what do I want it to be able to touch?

The eight islands

Here's how mine break down — and, more to the point, why each one earns its own island.

Work. My employer issues me a laptop and a phone, and I don't control what's on them or how they're managed. That's not a complaint; it's just not my gear. My employer has a lot of sensitive intellectual property and customer data. So it gets its own island, walled off from the family's devices and my personal files. If something ever goes sideways on the home side, it stays on the home side.

The kids. Their phones, tablets, and laptops share an island — partly so I can put tighter content filtering and time limits on just that group without imposing them on the whole house, and partly because, let's be honest, kids click things. When their friends come over to the house and ask for internet access they get added to the kids network.

The smart-home stuff. All the internet-of-things gear — plugs, bulbs, sensors, the odds and ends that make a house “smart.” As a category these are the least trustworthy devices I own: cheap, rarely updated, and forever phoning home. They get an island with strict rules and no path to my computers.

Media. TVs, streaming boxes, the receiver, the game console. Chatty, bandwidth-hungry, always reaching out to some service — I'd rather that noise stay in one place. Corralling it onto one island buys me something that has nothing to do with security, too: I can hand that traffic priority with QoS, so a movie doesn't stutter the second someone else kicks off a fat download. Streaming wins the tie-breaker, on purpose.

Cameras. This is the one that surprises people: the security cameras are quarantined harder than almost anything else. Internet-connected cameras have a genuinely ugly track record, and a camera is the last thing you want a stranger reaching. So they sit on a locked-down island, recording locally, with no way in from outside.

The public island — DMZ and Guest. A handful of things actually do need to be reachable from the internet, and those live out front in what's traditionally called a DMZ, deliberately kept at arm's length from everything private — on the assumption that anything facing the internet will eventually get poked at. Guest Wi‑Fi lives out here too: visitors get real internet and nothing else. They never touch the rest of the house.

Admin. And finally the island that runs the whole thing — the firewall, the switches, the Wi‑Fi hardware, and my own trusted devices. This is the one island allowed to reach the others, because that's how I manage them. It's also the one I guard hardest, because it holds the keys.

The rules between the islands

Islands are only half of it. The other half is the rules about who may talk to whom — and the default is the important part: deny everything, then allow back the few things that make sense.

In plain terms: nothing comes in from the internet except to that public island out front. The private islands can reach the internet, and they can reach the public servers when they need to, but they can't reach each other — the plug can't see the cameras, the cameras can't see the kids' tablets, the work laptop can't see any of it. Admin can reach everything; nothing reaches back into admin uninvited. Also, no island can call China. Ever.

That's the whole philosophy in one line: everything's isolated by default, and every connection that does exist is one I chose on purpose.

Is this overkill for a normal house?

Honestly, eight networks is more than most homes need—and I won’t pretend I set this up in an afternoon. If you want to build something similar, you’ll likely need more capable gear. Most Wi-Fi routers can broadcast at least two SSIDs: a main network and a guest network. Some systems, such as Netgear Orbi and Orbi Pro, support three or four, respectively, but relatively few consumer setups can handle eight. I have a step-by-step guide on the way, along with a companion piece explaining how to do it with Firewalla—the gear that powers my network and fully supports all eight SSIDs. Keep an eye out for both. What started as a hobby simply ran off in a direction I happen to be good at.

If you do nothing else, do this: put your smart-home gadgets and your guests on a network separate from your computers and phones. That one split — trusted things on one side, cheap and disposable things on the other — buys most of the protection for almost none of the effort. Two networks instead of one is a real upgrade over how most houses are wired.

The rest of my islands are just that same instinct, carried further than a reasonable person would.

If you ever want a hand thinking through how to segment your own network — or that smart-plug story left you a little uneasy — that's exactly the kind of thing I help people with.