My home network used to be a flat mess. Everything on the same subnet, the printer talking to the server, IoT devices on the same SSID as my laptop, no local DNS – just a consumer router doing its best. It worked, right up until the day my smart TV started doing things I couldn’t explain and I realized I had no visibility into what was actually happening on my own network.

I rebuilt it properly about two years ago. Here’s how it’s laid out now.

The Hardware

The core is a GL.iNet GL-MT6000 (Flint 2) running OpenWrt. It’s a small, fanless router with 2.5GbE WAN and LAN ports and solid OpenWrt support out of the box. I chose it over the Ubiquiti UniFi path because I wanted full OpenWrt access without paying for a cloud management subscription or maintaining a separate controller device.

For switching I’m using a TP-Link TL-SG108E 8-port smart switch. It’s not a managed switch in the enterprise sense, but it supports 802.1Q VLANs which is all I need. The price-to-capability ratio is hard to beat.

Wireless APs are two TP-Link EAP670s running in standalone mode. No controller, no cloud account. They handle 802.11ax on both bands and support multiple SSIDs mapped to different VLANs.

The VLAN Layout

I run four VLANs:

VLAN 10 – Trusted – My computers, phones, and the Unraid server. Full internal access, DNS through AdGuard Home. This is where 90% of my traffic lives.

VLAN 20 – IoT – Smart TVs, Roku, game consoles, smart home devices. Can reach the internet but can’t initiate connections to VLAN 10. The Unraid server can reach IoT devices (for Home Assistant) but not vice versa. This one change alone fixed the “what is my TV doing” problem.

VLAN 30 – Guest – Isolated internet access, nothing else. I give this SSID to visitors without worrying about what they’re doing. Rate limited to 50Mbps so one guest can’t hog the connection.

VLAN 40 – Servers – DMZ-style isolation for anything exposed to the internet. Right now that’s just Nginx Proxy Manager. Strict firewall rules in both directions.

Local DNS with AdGuard Home

AdGuard Home runs on my Unraid server in Docker. It serves two purposes: ad blocking and local DNS resolution.

The DNS side is what changed how I use my home network. Every service gets a real hostname. Instead of remembering that Jellyfin is at 192.168.10.25:8096, it’s just jellyfin.home. Nextcloud is nextcloud.home. Uptime Kuma is kuma.home. The router points all clients to AdGuard Home for DNS, and AdGuard Home has a rewrite rule for each service pointing to the server’s IP.

The ad blocking is a bonus. I use the Hagezi Pro blocklist plus the Steven Black hosts file. The block rate on my network is usually around 18-22% of all DNS queries.

The Machine That Does Too Much

The Unraid server is nominally a storage and media server. But it also runs AdGuard Home, Nginx Proxy Manager, Vaultwarden, Nextcloud, Home Assistant, and Ollama. At some point it stopped being a NAS and became the infrastructure backbone of my house.

This is fine as long as you’re aware of it. The problem comes when the server needs maintenance. Taking it offline for a drive replacement or Unraid update means losing DNS, which means all my local hostnames stop working, which means half the smart home features stop working. I’ve learned to schedule maintenance carefully.

The right answer is redundancy – a second Pi-hole or AdGuard instance as a backup DNS server. I haven’t gotten there yet. It’s on the list.

Firewall Rules: What Actually Matters

The VLAN topology is only as good as the firewall rules enforcing it. OpenWrt makes this manageable with its zone-based firewall. Each VLAN is a zone, and you define traffic policies between zones.

The rules that matter most in my setup:

  • IoT cannot initiate connections to Trusted (but Trusted can reach IoT)
  • Guest is fully isolated from everything except WAN
  • Servers VLAN can only receive connections from Trusted, never initiate them outbound to Trusted
  • All inter-VLAN routing blocked by default; rules are explicit allowlists, not denylist

The last point is important. If you start from “allow all” and try to block things, you’ll miss something. Start from “block all” and explicitly allow what you need.

What I’d Change

I’d add a proper UPS on the networking gear. The server has a UPS, but the router and switches plug straight into the wall. A power blip that doesn’t kill the server still kills the network, which means the server loses connectivity. A small APC BX1500M on the networking stack would fix this.

I’d also set up a backup DNS instance earlier. Every time I reboot the server for maintenance I regret not having a fallback.

Next post: the AI agent that manages my WordPress sites while I sleep. That one gets into the automation side of all this infrastructure.

Products mentioned in this post:

Affiliate disclosure: Some links in this post are Amazon affiliate links. If you buy through them, I get a small commission at no cost to you. It helps keep the lights on here.