Private Home Network Setup: Router, DNS, Isolation, and Remote Access
A useful home privacy setup has clear boundaries. Personal devices can reach local services. Cameras and other connected devices cannot open connections to personal devices. Guests cannot see either group. Remote access uses an encrypted tunnel instead of a public admin page or camera port.
You can build this with OpenWrt, OPNsense, a router that supports separate networks, or managed access points and switches. Product names differ. The checks at the end show whether the boundary works.
| Network | Devices | Can reach | Blocked from |
|---|---|---|---|
| Trusted | Phones, laptops, tablets | Internet and selected local services | Router administration from ordinary devices when a separate admin network exists |
| Servers | NAS, Home Assistant, Frigate, local AI | Updates and selected trusted devices | Guest devices; other access unless a service needs it |
| Cameras and IoT | Cameras, TVs, speakers, appliances | Local recorder, DNS, and time only when required | Trusted devices, router administration, and general internet access |
| Guest | Visitor devices | Internet | Trusted, server, camera, and router networks |
| Administration | One maintained computer | Router, switch, access points, and servers | Ordinary browsing and untrusted devices |
Before changing the router
- Download the current configuration backup.
- Record the internet connection settings supplied by the provider.
- List every device, its owner, and whether it needs local or internet access.
- Confirm that the router can create separate interfaces, guest networks, or VLANs.
- Keep a wired computer available in case Wi-Fi settings fail.
1. Put the router under your control
- Install the latest supported firmware from the router or firmware project.
- Set a unique administrator password and remove unused administrator accounts.
- Disable administration from the internet-facing interface.
- Disable UPnP unless a specific device requires automatic port mapping.
- Turn off cloud administration when local administration is available.
- Record the firmware version and set a date to check for updates.
On OpenWrt, set the root password before exposing the router to ordinary use. OpenWrt's security documentation notes that a new installation starts with passwordless local administration until that password is set.
2. Create separate networks
Create at least Trusted, Devices, and Guest networks. Add Servers and Administration when the router and switches can keep those groups separate. Give each network its own address range and DHCP scope so logs and firewall rules remain readable.
If the hardware does not support VLANs, use separate SSIDs backed by isolated router interfaces. Do not assume that a different Wi-Fi name creates isolation. It must connect to a separate firewall zone or guest-network function.
3. Write the firewall from required connections
| Source | Destination | Action |
|---|---|---|
| Guest | Internet | Allow |
| Guest | All local networks and router administration | Block |
| Cameras and IoT | Trusted and administration networks | Block |
| Cameras | Local recorder address and required stream ports | Allow |
| Trusted | Selected local services | Allow |
| Remote tunnel | Only the local services used remotely | Allow |
| Any other new path | Any local network | Block until required |
Keep the default cross-network action blocked. Add narrow rules for actual services. A camera recorder may need RTSP streams from cameras, while cameras do not need to initiate connections back to laptops.
4. Choose and enforce DNS
Decide whether the router will forward encrypted DNS to a selected resolver or run a local validating resolver such as Unbound. Point each local network to the router for DNS. Block direct outbound DNS from device networks when you need all devices to use the selected path.
Encrypted DNS protects the request between the router and resolver. The resolver can still receive the query, and the destination address remains visible elsewhere in the connection path. The private DNS guide compares the resolver and protocol choices in more detail.
5. Isolate cameras and connected devices
- Move one camera or connected device to the Devices network.
- Give a fixed DHCP lease to anything referenced by a firewall rule.
- Allow the local recorder to receive the required camera stream.
- Block the device from reaching Trusted and Administration.
- Block general internet access.
- Test live view, recording, time, restart, and power recovery.
- Add only the narrow outbound exception required by a function you choose to keep.
For a local recorder, the Frigate camera network guide covers stream separation, storage, authentication, and failure tests.
6. Use a tunnel for remote access
Do not publish router, NAS, Home Assistant, Frigate, or camera administration pages directly to the internet. Use WireGuard or a managed WireGuard-based network such as Tailscale. Limit the remote identity or peer to the services it needs.
Tailscale access rules can restrict a user or tagged device to selected addresses and ports. A direct WireGuard setup uses peer keys and AllowedIPs. In both cases, remove old peers, keep private keys off shared devices, and test access from mobile data rather than the home Wi-Fi.
7. Verify the boundary
- Connect a guest device and confirm that the internet works.
- From the guest device, try the router address and one trusted-device address. Both should fail.
- From a camera or device network, try a trusted address. It should fail.
- Confirm that the recorder still receives each camera stream.
- Check router logs for blocked outbound requests from cameras and connected devices.
- Change a client DNS setting and confirm that direct DNS is blocked when enforcement is enabled.
- Turn off home Wi-Fi on a phone and connect through the remote tunnel.
- Scan the public address from outside and confirm that no administration or camera ports are open.
Keep it working
- Save a configuration backup after every verified change.
- Keep a plain list of networks, address ranges, SSIDs, and allowed paths.
- Review connected devices and remote peers each month.
- Check router, access-point, server, and camera firmware on a fixed schedule.
- Repeat the isolation checks after a router reset, firmware upgrade, or new access point.
- Remove firewall rules whose device or service no longer exists.
Sources
- OpenWrt: isolated guest Wi-Fi
- OpenWrt: security features and initial administration
- OpenWrt: DNS and encrypted resolver options
- WireGuard: official quick start
- Tailscale: access policy syntax and tests
- Frigate: camera stream configuration
Reviewed 5 August 2026.
Frequently Asked Questions
What is the simplest private home network layout?
Use one trusted network for personal devices, one isolated network for cameras and other connected devices, and one guest network. Block the isolated networks from reaching trusted devices. Give cameras no internet access unless a documented function requires it.
Do I need VLANs for a private home network?
VLANs are useful when the router and switches support them, but separate guest or IoT networks can provide the same basic boundary on simpler hardware. The result to verify is that an isolated device cannot open an address on the trusted network.
Should a home camera network have internet access?
A local camera sending RTSP or ONVIF streams to a local recorder usually does not need general internet access. Block outbound traffic, keep time and update exceptions explicit, and test recording after the block is active.