A smart home mixes trusted users, servers, cameras and inexpensive IoT devices. A flat network is simple but weak; excessive segmentation can make the home fragile and frustrating.
Networkingrunning
Building an enterprise-ish home network without making it unusable
Segmentation, resilient Wi-Fi and proper identity experiments—balanced against the fact that ordinary people still need the television to work.
Group devices by trust and operational need, keep policies understandable, design Wi-Fi for real use, and introduce stronger identity controls through measured experiments rather than a single disruptive redesign.
The network is running with deliberate segmentation, multiple access points, PoE infrastructure and separate roles for users, services and IoT. WPA3 Enterprise, RADIUS and certificate-based EAP-TLS remain areas of controlled experimentation.
Abstract architecture / sensitive detail removed
01 Internet edge
02 Routing and policy
03 Trusted devices
04 Services
05 IoT and automation
Enterprise-ish, deliberately
The goal is not to cosplay a corporate network. It is to borrow useful ideas—segmentation, managed Wi-Fi, central visibility, PoE and identity-aware access—at a scale that one person can operate and everyone in the house can live with.
Trust without a public topology
The public architecture groups the network into roles rather than publishing live VLAN names, addressing, firewall rules, radio placement or camera coverage. Trusted clients, local services and less-trusted devices have different needs, but selected flows still need to cross those boundaries for Home Assistant and everyday discovery to work.
Identity experiments
WPA3 Enterprise and RADIUS offer a more interesting identity model than a shared password. Certificate-based EAP-TLS is the next edge of that work, with device onboarding and recovery treated as seriously as the authentication itself.
Notes to future me
What this project is teaching me.
- Security boundaries have an ongoing operational cost.
- IoT isolation must preserve the flows that make automation useful.
- A household network succeeds when security improvements remain livable.
This page explains design intent and lessons without publishing credentials, private addressing, access paths, device identifiers or a complete security topology.