Segmenting IoT on enterprise and home networks
In short: Segmentation puts IoT devices on their own network zones so a compromised device cannot reach laptops, servers or other devices. Use VLANs and separate Wi-Fi networks, then a default-deny firewall that allows only the traffic each device actually needs.
Why segment IoT
You cannot harden most IoT devices to the standard of a managed laptop. You often cannot install security software on them, patch them on your schedule or even change some settings. What you can control is what they are allowed to talk to. Segmentation limits the blast radius: if a camera is compromised, it can reach only the recorder it serves, not the finance server or the HR laptop.
Enterprise design
Group devices by function and risk, give each group a VLAN (and a matching SSID for wireless devices), and route between VLANs through a firewall rather than letting the core switch route everything freely.
| Source | Destination | Allow |
|---|---|---|
| Cameras (VLAN 40) | NVR on VLAN 20 | RTSP and the vendor's recording ports only |
| Cameras (VLAN 40) | Anything else | Deny, including the internet |
| Building systems (VLAN 50) | Vendor cloud addresses | HTTPS (TCP 443) only |
| Admin jump host | IoT VLANs | HTTPS and SSH for management |
| IoT VLANs | Internal DNS and NTP servers | DNS (53) and NTP (UDP 123) |
| Any IoT VLAN | Any other IoT VLAN | Deny (no lateral movement) |
On a Cisco-style switch and router, the building blocks look like this. Adjust addresses to your design.
vlan 40
name IOT-CAMERAS
interface GigabitEthernet1/0/12
switchport mode access
switchport access vlan 40
spanning-tree portfast
!
ip access-list extended IOT-CAMERAS-IN
permit tcp 192.168.40.0 0.0.0.255 host 192.168.20.15 eq 554
permit udp 192.168.40.0 0.0.0.255 host 192.168.20.53 eq 53
permit udp 192.168.40.0 0.0.0.255 host 192.168.20.123 eq 123
deny ip any any log
interface Vlan40
ip address 192.168.40.1 255.255.255.0
ip access-group IOT-CAMERAS-IN inAdd NAC (network access control) so devices land in the right VLAN automatically. Devices that support 802.1X authenticate with certificates; simpler devices use MAB (MAC Authentication Bypass) combined with profiling, since MAC addresses are easy to fake. Enable port security and turn off unused switch ports.
Home and small office design
Many home routers offer a guest network with client isolation; using it for smart plugs, bulbs and TVs is a quick win. Routers running OpenWrt, OPNsense or similar, or prosumer kit with VLAN support, let you create a dedicated IoT network with proper firewall rules: IoT may reach the internet, the trusted network may reach IoT, but IoT may not start connections into the trusted network.
Practical problems and how to solve them
- Discovery breaks. Casting and smart-home apps use multicast DNS and SSDP, which do not cross VLANs. Use an mDNS reflector or the firewall's discovery proxy, limited to the specific segments that need it.
- Smart-home hubs. Zigbee, Thread and Matter devices talk through a hub or border router. Put the hub on the IoT segment and allow your phone or controller only the ports it needs.
- Cloud dependency. Some devices need many cloud addresses that change often. Use DNS-based or category-based firewall objects rather than fixed IP lists.
- Visibility. Log denied traffic from IoT segments; a camera trying to reach random addresses is an early warning.
Tip: build segmentation from an inventory. Discover what is on the network, record what each device needs to talk to, then write the rules. Guessing leads either to broken devices or to overly broad "allow any" rules.
Practice
Why route IoT VLANs through a firewall rather than only using switch VLANs?
Your Chromecast stops working after moving it to the IoT VLAN. What is the likely cause and fix?
Why is MAB alone weak for IoT access control?
Key takeaways
- Segmentation limits the blast radius when an IoT device is compromised.
- Give each device class its own VLAN or SSID and route through a firewall.
- Use default deny and allow only the specific flows each device needs.
- NAC places devices automatically; 802.1X is stronger than MAB.
- Handle discovery protocols carefully and log denied IoT traffic.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.