My network was one big room — blog.stancs.com

Most home networks are one big room. Mine was too, and I knew it in the way you know a closet needs cleaning: abstractly, and never today. I’d taken runs at segmenting it before, too, and never quite landed it — half-built VLANs, rules I didn’t trust, a guest network that only pretended to be one. This was the attempt to actually get it right.

So I made it someone else’s job. I gave my assistant a scoped API key to my UniFi gateway and asked a simple question — what is actually on this network? — and then let it read the answer straight from the controller instead of me squinting at a client list.

The inventory

It pulled the whole picture through the API: every connected client, every access point and switch, every network and Wi-Fi SSID, and the firewall configuration. Then it grouped what it found.

The shape was the problem. Well over a hundred devices, and almost all of them sharing a single flat network:

a stack of cameras, most of them wireless
a long tail of IoT — plugs, sensors, hubs, the usual smart-home sprawl
a lot of Apple devices, phones and tablets and laptops
a few servers and a NAS doing the actual important work
some of it wired, most of it wireless

All of that, on one segment, inside one firewall zone. There was a “guest” Wi-Fi, but on inspection it wasn’t isolated from anything — a guest network in name only. And the internal firewall, the part that’s supposed to decide who can talk to whom inside the house, had essentially one custom rule to its name.

Why one big room is a bad room

Here’s the thing about a flat network. Every device can reach every other device. That’s convenient — it’s why everything “just works” — and it’s exactly the risk.

The weakest thing on my network is not the NAS or the servers. It’s the cheapest gadget: a discount smart plug running firmware from who-knows-when that will never see another update. On a flat network, if that plug is ever compromised, nothing stands between it and the machine holding everything that matters. It can see the whole room.

Cameras are their own version of this. A camera that can reach the open internet is a camera that can phone home to places you didn’t choose. On a flat network, locking that down is all-or-nothing.

None of this is exotic. It’s just the default, and the default quietly optimizes for “works” over “contained.”

Building walls

The fix is segmentation: stop treating the network as one room and split it into several, grouped by how much damage a device could do if it turned on you. Trusted personal machines in one place. The smart-home sprawl in another. Cameras in their own. A real, isolated guest network. And a holding pen for anything new and unknown until I’ve decided I trust it.

Then the important rule: the walls default to closed. Segments can’t talk to each other unless I’ve explicitly written down that they can. The smart-home zone gets to reach the internet but not the machines that matter. Cameras get kept off the internet entirely, with narrow exceptions. Guests get the internet and nothing else. The one piece that legitimately needs to reach across — the home-automation hub that has to see the smart-home devices — gets a specific, named exception rather than a hole you could drive a truck through.

The design constraint I cared most about: don’t renumber the things that already work. The servers and the infrastructure have addresses that a dozen other things quietly depend on. Move those and you spend a weekend chasing breakage for zero security gain. So the trusted core stays exactly where it is, and the untrusted stuff gets peeled off into new segments around it. Lower risk, same payoff.

There’s a subtlety that bites everyone who does this, and it’s worth stating plainly: the moment you put walls up, casting and speakers and printer discovery stop working, because the little “hey, I’m over here” announcements those devices broadcast don’t cross the walls on their own. You have to deliberately let that one kind of chatter through, or you’ll segment your network and then spend a week wondering why the TV can’t find the speakers. Ask me how I know.

Working with an assistant that has a key

The genuinely new part of this wasn’t the networking. It was doing it conversationally — “what’s on here,” “group it by type,” “which of these has no business talking to the NAS” — against the live system, with an assistant that could both read the current state and make the change.

That cuts both ways, and it’s worth being honest about. An assistant with write access to your firewall is exactly as consequential as it sounds. Mine was careful — it identified a sensitive device three different ways before it would touch it, and it refused to when it wasn’t certain — but it also, at one point, confidently told me a change had broken something. I made it prove it. It went back, actually tested the path, and walked its own claim back: the thing it thought it broke was fine. That exchange is the whole game. The value isn’t a tool that’s always right. It’s a tool that will show its work when you push, and that you’ve built the habit of pushing.

Where it stands

The audit is done and the walls are going up — segments defined, the wireless side moved onto them, a proper guest network standing where the fake one used to be. Cameras and the internal firewall rules are the next pass, and I’ll take the speaker-discovery lesson above as a warning, not a surprise.

One big room, becoming a house with doors. Slowly, and on purpose this time.