Why separate smart devices from work devices
Smart devices are often the hardest things on a home network to keep updated. The UK NCSC advises avoiding devices whose support period will end soon, and says that out-of-support smart devices are easier to hack or may stop working altogether. The FTC advises changing default passwords, updating firmware and turning off unused features such as remote management. [1][2]
The FTC recommends a guest network with its own name and password, so that a guest's infected device does not get onto your primary network. Our reasoning is that the same separation helps with a smart plug or camera you cannot fully trust or update. CISA notes that a properly configured firewall can be a barrier against threats from inside the network too. [3][4]
Guest network or VLAN: the trade-offs
| Guest network (GL.iNet panel) | VLAN (OpenWrt LuCI) | |
|---|---|---|
| Setup effort | A few switches in NETWORK, Guest Network [5] | Bridge VLAN configuration and firewall zones [6] |
| Wired devices | GL.iNet describes it as a separate Wi-Fi network [5] | Ports can be assigned to VLANs [6] |
| Isolation controls | Own subnet (default 192.168.9.1), AP Isolation, Block WAN Subnets [5] | Firewall zones and rules you write [6] |
| Support | Documented in GL.iNet firmware 4 docs | No VLAN page in GL.iNet's firmware 4 docs index (checked 30 Oct 2026); LuCI is maintained by OpenWrt [7][8] |
| Risk | Low; easy to turn off | Misconfiguration can lock you out of the router [6] |
Setting up the guest network on GL.iNet firmware
The guest network is under NETWORK, then Guest Network. GL.iNet says it is isolated from the primary network. Its gateway defaults to 192.168.9.1 with a 255.255.255.0 netmask, and a DHCP server turns on with it. Change the gateway if it clashes with another network you use. [5]
Two options matter. AP Isolation (since firmware 4.5) stops devices on the guest network from talking to each other. Block WAN Subnets (since firmware 4.8) stops guests reaching the upstream network, such as your ISP gateway and anything plugged into it. [5]
The VPN dashboard can treat the guest network as its own connection type. So you can send smart devices out through the normal WAN while work devices use a tunnel, or the other way round. [9]
When a VLAN is worth the effort
A VLAN makes sense when wired devices also need separating, such as a smart-home hub or a camera recorder. It also makes sense when you want specific rules, like letting a phone reach a printer while blocking everything else.
We found no VLAN page in GL.iNet's firmware 4 documentation index. On OpenWrt, VLANs are set up with bridge VLAN sections, by editing the network configuration or in LuCI. OpenWrt's DSA tutorial warns that at least one interface must keep an address and a firewall zone that accepts input, or you lose access to the router. It also says some hardware cannot mix tagged and untagged VLANs on one port, and advises against using VLAN 1 for data networks. [7][6]
GL.iNet says LuCI is maintained by OpenWrt and GL.iNet is not responsible for it. Treat a VLAN build as your own project, and write down every change. [8]
What breaks, and workable compromises
Casting is the most common casualty. Google's Cast FAQ says devices must be on the same home network and AP or client isolation must be off. It also says you cannot cast through a guest, hotel or public network with isolation. A TV on the guest network and a phone on the main network will not see each other. [10]
Phone apps that set up or control devices over the local network can fail in the same way. A device that is controlled through the manufacturer's cloud may keep working. One that is discovered locally may not. Test each device after you move it.
- Keep TVs and speakers you cast to on the main network; move plugs, bulbs, cameras and sensors to the guest network.
- If a device needs its app on the same network for setup, briefly join your phone to the guest network to set it up, then switch back.
- Keep work laptops on the main network, or on a VPN tunnel group of their own.
Test checklist after the split
- From a phone on the guest network, try to open the router admin page and a shared folder on your work laptop. Both should fail; GL.iNet's page does not document this, so confirm it. [5]
- With Block WAN Subnets on, try to open the ISP gateway's page from the guest network. It should fail. [5]
- Confirm each smart device still works from its app, both at home and on mobile data.
- Change default passwords on each device and turn on updates where offered. [2][1]
- Note each device's support end date if the maker publishes one. [1]
Questions before you decide
Why can I not cast to my TV after moving it to the guest network?
Google's Cast FAQ says casting needs devices on the same home network, and that you cannot cast through a guest or public network with AP or client isolation. Keep the TV on the network your phones use, or accept that casting will not work across the split.
Does GL.iNet's guest network block access to my main LAN?
GL.iNet describes the guest network as isolated from the primary network and documents AP Isolation and Block WAN Subnets. Its page does not spell out whether guests can reach LAN devices or the admin panel, so test it from a guest device before you rely on it.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- UK NCSC: Smart devices in the home Accessed 30 Oct 2026
- FTC: Securing your internet-connected devices at home Accessed 30 Oct 2026
- FTC: How to secure your home Wi-Fi network Accessed 30 Oct 2026
- CISA: Home network security Accessed 30 Oct 2026
- GL.iNet Router Docs 4: Guest Network Accessed 30 Oct 2026
- OpenWrt: DSA mini tutorial (bridge VLANs) Accessed 30 Oct 2026
- GL.iNet: firmware 4.x documentation source (page index) Accessed 30 Oct 2026
- GL.iNet Router Docs 4: What is LuCI Accessed 30 Oct 2026
- GL.iNet Router Docs 4: VPN Dashboard Accessed 30 Oct 2026
- Google Cast Help: Casting to your TV/display or speaker FAQ Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.