Separate your work laptop, your smart TV, and that IoT bulb you don’t fully trust onto their own networks — without buying enterprise gear.
netdaemons.com · Home & SMB Series · Article #16 · 4 August 2026
Your smart bulb shows up in a botnet scan and you only find out because your ISP calls about it. Your kid’s game console floods the network mid-video-call. Your work laptop and a no-name smart doorbell sit on the exact same network, able to reach each other directly, though neither has any reason to.
None of these devices need to talk to one another. On a typical home network, they all can — everything from your laptop to your light bulb shares one flat network with no walls between them. This guide shows you how to build those walls using VLANs — how to setup VLAN home Wi-Fi step by step.
| Disclaimer: General: The NetDaemons team has researched and tested the steps in this guide at time of writing. Router interfaces change with firmware updates — menu names and locations may differ slightly from what is described here. Readers in India, the Middle East, and Southeast Asia should also confirm directly with their own ISP whether VLAN tagging and bridge mode are supported on their connection, since this varies by provider and is not always documented officially. Pricing: Product prices mentioned below are indicative Amazon India street prices, not guaranteed selling prices. Availability: Product availability is indicative and may change. Verdicts: Recommendations reflect the independent technical opinion of the NetDaemons team. This article contains affiliate links — if you purchase through these links, NetDaemons may earn a commission at no extra cost to you. |
Before You Do Anything
VLAN setup is not a five-minute job, and not the right fix for every home. Answer these honestly first.
1. Does your router actually support VLANs?
Check carefully — many routers list ‘VLAN’ in their spec sheet but only support it for WAN-side ISP compatibility, not for creating separate LAN networks with their own Wi-Fi names, which is what this guide covers. Most stock Jio Fiber, Airtel Xstream, BSNL FTTH, and ACT Fibernet routers expose neither.
2. Do you actually have devices worth isolating?
A laptop, a phone, and a smart TV do not need this yet. VLANs earn their complexity with several IoT devices, sensitive work data, or untrusted guests. Otherwise, your router’s built-in Guest Network usually gets you most of the benefit for far less effort.
3. Are you comfortable working without an undo button?
A misconfigured VLAN can lock you out of the admin page or cut devices off mid-change. Set aside a weekend afternoon, not ten minutes before a work call.
4. Will your ISP even allow this?
No official answer exists. Jio, Airtel, BSNL, ACT, and most Middle East and Southeast Asia fibre operators do not publish clear guidance on VLAN pass-through or bridge mode — reports are mixed even among their own support staff. Test it on your own connection rather than assuming.
What Is Actually Causing This
On a stock home network, every device sits inside one flat broadcast domain — a group of devices that can all see and directly reach each other, with no router or firewall in between.
That is convenient for finding a network printer or casting to a smart TV. It becomes a problem when a compromised or poorly-secured device — cheap IoT gadgets are frequently both — sits in that same domain as the laptop you use for banking and work.
A VLAN (Virtual Local Area Network) splits one flat network into several logically separate networks that still share the same router and Wi-Fi radios. Devices on one VLAN cannot reach devices on another unless you explicitly allow it — the same principle enterprise networks use to keep finance systems separate from guest Wi-Fi, scaled down to a home router.
| From the field — A VLAN makes the connection more secure by logically splitting devices into separate, air-tight compartments. Devices in one VLAN cannot reach a device in another VLAN. This is commonly used to keep devices handling financial or other confidential data — such as your laptop or desktop — separate from devices that are open to the internet by design, such as a Chromecast, Firestick, or other IoT appliance. |
The Fix
Group 1: Plan Your VLANs Before You Touch a Setting
Step 1: Decide how many VLANs you actually need
What to do: Write down your devices in three rough groups — Main (laptop, phone, work devices), IoT (bulbs, plugs, cameras, smart TV), and Guest (visitors’ phones).
Why it matters: Every VLAN you add is another thing to troubleshoot later. Most homes get nearly all the benefit from just these three groups.
What to expect: A short list on paper. Nothing changes on your network yet.
Step 2: Note your router’s current LAN subnet
What to do: Check the LAN or Network settings page for the current subnet — typically 192.168.1.0/24 or 192.168.29.0/24 on Jio Fiber.
Why it matters: New VLANs need subnets that do not overlap with this range, or devices can end up with duplicate IPs and stop working.
What to expect: A pattern for most homes: keep Main as-is, assign IoT to 192.168.20.0/24, Guest to 192.168.30.0/24.
Group 2: Create the VLANs on Your Router
Step 3: Log into your router’s admin interface
What to do: Go to your router’s admin address — 192.168.1.1 for ASUS/most TP-Link, 192.168.29.1 for Jio Fiber, 192.168.0.1 for some BSNL/Airtel units.
Why it matters: If there is no VLAN section anywhere in Advanced or Network Settings, stop here — see ‘When the problem is bigger than this guide’ below.
What to expect: A dashboard labelled Network, Wireless, or Advanced, depending on brand.
Step 4: Create each VLAN with its own ID and subnet
What to do: Create one entry per group from Step 1 — an ID (any unused number 2–4094, e.g. IoT = VLAN 20) and the subnet from Step 2.
Why it matters: The VLAN ID is tagged onto every packet so the router knows which logical network it belongs to.
What to expect: Your VLAN list shows two or three entries beyond the default. Do not connect devices yet.
Group 3: Put Your Wi-Fi Networks on Separate VLANs
Step 5: Create a separate Wi-Fi network (SSID) per VLAN
What to do: Add an SSID for IoT (‘HomeIoT’) and Guest (‘HomeGuest’), and bind each to its VLAN ID from Step 4. Leave your main SSID as-is.
Why it matters: A bulb joining ‘HomeIoT’ lands on VLAN 20 automatically — this is what actually separates devices in practice.
What to expect: Three Wi-Fi networks visible from your phone. Reconnect one IoT device as a test first.
Group 4: Wired Devices, if Any
Step 6: Set VLAN membership on LAN ports, if you have a managed switch
What to do: For a NAS, desktop, or wired camera on a managed switch, assign each port to the correct VLAN. No managed switch? Skip this for now.
Why it matters: Wired devices are only separated if their port is configured for the right VLAN — Wi-Fi devices get theirs from the SSID.
What to expect: Wired devices split across VLANs, or unchanged if you skipped this — both are fine outcomes.
Group 5: Stop VLANs From Talking to Each Other
Step 7: Add firewall rules to block inter-VLAN traffic
What to do: In Firewall or Access Control, block traffic from IoT to Main and from Guest to Main, while still allowing both out to the internet.
Why it matters: Without this step you get organisation but not security — VLANs can often still reach each other by default.
What to expect: IoT devices still reach the internet but cannot reach or ping a device on Main.
How to Verify It Worked
Confirm the VLANs are actually working before you trust them.
- On a laptop on Main, check its IP (Windows: ipconfig, Mac: System Settings → Network) — it should be in your original subnet, not IoT or Guest.
- Connect a phone to IoT or Guest and confirm it gets an address in that VLAN’s subnet — 192.168.20.x, for example.
- From a Main device, try to ping or browse to a device on the IoT VLAN. This should fail if isolation is working.
- Confirm the IoT device still works in its own app — reaching the internet but not your laptop is the outcome you want.
If This Did Not Fix It
If devices land on the wrong VLAN, or isolation is not holding, these are the most common causes.
The router tags VLANs on wired ports but not on Wi-Fi
Some routers only support VLAN on physical LAN ports, with no way to bind an SSID to a VLAN ID. If Wi-Fi devices keep landing on the default network regardless of SSID, this is almost certainly why.
Settings revert after a reboot or firmware update
Budget firmware occasionally fails to persist VLAN and firewall rules across a reboot. Check the firmware changelog and disable auto-updates until settings prove stable.
The ISP-supplied device upstream is blocking VLAN tags
A gateway not in bridge mode (passing traffic through without its own routing) can strip VLAN tags before they reach your router — common on Jio Fiber and Airtel FTTH. Call your ISP and specifically request bridge mode.
| From the field — A pattern worth knowing: when a VLAN configuration looks correct on paper but isolation is not holding, double-NAT and an un-bridged ISP gateway are consistently the first things to rule out before assuming the VLAN settings are wrong. |
When the Problem Is Bigger Than This Guide
VLANs only get you this far if your router truly supports them — and if your ISP’s gateway allows the tags through. Most budget TP-Link and ASUS routers only expose VLAN for WAN-side ISP compatibility, not LAN networks with their own SSIDs.
MikroTik hAP ax2
The most straightforward genuine option. This runs RouterOS, built for exactly this configuration — real LAN VLAN tagging, SSID-to-VLAN binding, and firewall rules exposed directly, the same way we would configure a small branch router at work. Steeper learning curve than an app-based interface — for readers who want to go further.
ASUS RT-AX86U Pro
ASUS confirms genuine LAN VLAN support (Guest Network Pro) on this model specifically — not present on every ASUS router. A real jump in price, but a familiar interface if RouterOS feels like too much.
TP-Link EAP225 Ceiling Mount Access Point
One caveat: an EAP225 alone, on a router that cannot deliver VLAN-tagged traffic, will not create separate networks by itself. It needs an Omada-capable gateway upstream — TP-Link sells this as the ER605 (listed on Amazon India as TL-R605, ₹6,159) — to pass VLANs to the access point. Buy it as a pair.
👉 Check price on Amazon India for TP-Link EAP225 Ceiling Mount Access Point
👉 Check price on Amazon India for TP-Link ER605 TL-R605 Omada VPN Router
| NetDaemons take: Whichever direction you take, the principle stays the same: decide what should and should not reach each other, and let the hardware enforce it instead of trusting every device by default. |
Have questions about your specific router, ISP, or device mix? Drop them in the comments — we read and respond to every one.
Related Articles
| Article | Why it is relevant | Status |
| Best Small Business Firewall Under ₹20,000 India | For home-office VLAN needs | LIVE |
| How to Fix Wi-Fi Dead Zones in Indian Apartments | Diagnose coverage before adding complexity | LIVE |
| How to Secure Your Home Wi-Fi Network | Foundational security to pair with VLANs | COMING SOON |
netdaemons.com · Home & SMB Series · August 2026 · See full disclaimer above. Router interfaces vary by firmware version and manufacturer. This article contains affiliate links.
