Four networks, one building: what actually goes where

Most homes run everything on one network with one password. The dog camera, the work laptop, the babysitter's phone and the kid's console all sit in the same room with the door open.

Why one network is a problem

Devices on the same network can generally see and reach each other. That's useful — it's how your laptop finds the printer. It's also how a compromised device finds everything else.

The realistic threat isn't a hacker targeting you personally. It's a cheap smart plug running firmware from 2019 that nobody will ever patch, sitting on the same network as the laptop with your client files on it. Or a guest's phone carrying something it picked up elsewhere. Segmentation means that when something goes wrong, it goes wrong in one room instead of the whole house.

The four-way split that works

1. Home

Laptops, phones, tablets, the TV. The devices you own and keep updated. This network gets full access to shared resources — printers, network drives, media servers — and priority for video calls.

2. Business

Work laptop, card reader, point-of-sale terminal, work printer, anything holding client data. Isolated from everything else in the building. If you run a business from home this is the most valuable of the four, and the one people most often skip.

3. Kids and guests

Internet access and nothing else. No path to your files, your printers, or your work devices. This is also where time limits and content filtering live — bedtime cutoffs, blocked categories, the ability to pause a single device from your phone.

Guests go here too. It already has exactly the right shape, and in practice most households hand out this password anyway.

4. Smart devices

Cameras, doorbells, thermostats, plugs, robot vacuums, TVs that phone home. These are the devices you have the least control over and the least visibility into. Fence them off. They still work — they reach the internet and your phone app reaches them through the manufacturer's service — but a device with stale firmware can't wander into your documents.

Why not more than four?

The equipment will happily broadcast eight network names. There's a real cost to doing so.

Every network name is announced continuously by every access point on every band. That announcement traffic consumes airtime, and airtime is the finite resource. More names means less capacity for actual data. The effect is worst on 2.4 GHz and worst in dense buildings.

It gets more serious if any of your access points connect back wirelessly rather than by cable. Those units use spare radio capacity to carry traffic to the router. Push past roughly four network names and you start eating the capacity that link depends on, and the whole system slows down.

Four is a considered ceiling, not a hardware limit. If someone offers you eight, ask what it costs you.

What separation actually means in practice

Two mechanisms do the work:

Network separation puts each group in its own logical space, so traffic can't cross between them without passing a rule you control.

Client isolation stops devices within a single network from seeing each other at all. This matters most on the guest side: your visitor's laptop shouldn't be able to see your child's tablet either.

Both are configuration, not extra hardware. Any competent business-class system does this. The reason most homes don't have it is that consumer routers make it awkward and nobody set it up.

The one trade-off to plan for

Separation is only useful if you also decide what's allowed to cross. A few things need thought:

• Printing. If the printer is on Home, the Business laptop can't reach it by default. Either put the printer where it's needed most or ask for a specific rule.
• Casting to the TV. Chromecast and AirPlay discovery doesn't cross networks by default. Fixable, but it has to be asked for.
• Smart home apps. Most work fine because they route through the manufacturer's cloud. Local-only systems may need a rule.

None of these are hard. They're just decisions that should be made deliberately at setup, rather than discovered three weeks later when nobody can print.