I put every smart device on its own VLAN, and found out which ones were phoning home constantly
A flat network has vulnerabilities.
In today's world, many smart devices like wireless plugs, IP cameras, and robotic vacuums rely on continuous internet access for vendor cloud connectivity. However, these devices can generate unsolicited telemetry, DNS lookups, and unencrypted data streams. When all devices share the same network, vulnerabilities arise. Network segmentation, implemented with VLANs and strict firewall rules, can isolate untrusted hardware and monitor outbound traffic.
DNS query logging and sinkhole integration can help identify persistent phoning-home behavior. Some devices hardcode DNS servers or use DNS over HTTPS, potentially missing local cache solutions like Pi-hole or AdGuard Home. Devices may ignore DHCP-advertised NTP servers and contact external time servers, which is usually essential but worth noting.
Devices stream device state, uptime metrics, and local environment diagnostics, creating multiple connection attempts. Network segmentation relies on managed switches and routers configured with 802.1Q VLAN trunking to separate physical switch ports and SSIDs into distinct subnets. Within each VLAN, dedicated DHCP scopes ensure that broadcast traffic doesn't leak across boundaries.
Firewall rules between VLANs should be explicitly denied, blocking IoT subnet traffic from initiating TCP or UDP sessions with trusted networks. Enforcing inter-VLAN firewall rules blocks unauthorized WAN access that could prevent firmware checks. By revoking internet access for specific IoT devices while retaining local subnet communication, you can protect your network from unauthorized port-scanning attempts, external firmware-check queries, and unrequested telemetry payloads.
Written by urgent.news from XDA Developers's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.