Six Access Points Is Too Many (On Default Settings): Planning Seven VLANs Without Losing My Mind

Normal homeowners set up Wi-Fi in about four minutes. They plug in whatever beige plastic router the fiber installer handed them, leave the network named isp-router-8842, tape an eighteen-character password to the side of the fridge, and go on to live happy, well-adjusted lives.

I, on the other hand, have six UniFi U6 In-Wall access points, a UDM Pro gateway, a Proxmox server, two people working remotely whose respective corporate environments have no business knowing the other exists, a slowly growing collection of smart-home gadgets that want to phone home to mysterious cloud buckets every twelve seconds, and a strong desire to never share a Layer 2 broadcast domain with a robot vacuum.

Here is how I’m planning the VLANs, switch ports, and radio layout so everything stays fast, isolated, and invisible.

---

1. Six Access Points Is Too Many (Until You Turn Half of Them Off)

Admitting you have six access points in a single house sounds completely unhinged until you picture how they’re mounted.

Instead of bolting glowing flying saucers to the middle of every ceiling, our house uses six UniFi U6 In-Wall (U6-IW) units mounted high up on the walls—blending in like clean white wall plates while clearing every desk, monitor, and sofa in the room.

Because high-wall mounting gives the antennas unobstructed line-of-sight, the catch is what happens if you plug six of them in and leave the radio settings on Auto.

In consumer and prosumer Wi-Fi gear, “Auto Transmit Power” is almost universally polite phrasing for “scream at the maximum legal regulatory limit.” Putting six full-power, unobstructed access points inside one home is like putting six tour guides with megaphones in the same living room, it’s noisy:

1. The Sticky Phone Problem: You walk upstairs, your phone still hears the living-room AP faintly through the floor, and it stubbornly clings to that terrible signal like a toddler holding onto a doorframe—while ignoring the fresh access point two meters away.
2. The 2.4 GHz Traffic Jam: The 2.4 GHz band punches straight through walls and only has three non-overlapping channels (1, 6, and 11). Turn 2.4 GHz on across six APs and you guarantee your own hardware will spend all day arguing with itself.

The planned fix is delightfully counterintuitive:

• Turn 2.4 GHz completely OFF on three of the six APs. Only three spaced-out units get 2.4 GHz enabled—pinned manually to Channels 1, 6, and 11 on Low power. The other three radios take a permanent vacation.
• Dial 5 GHz down to Low power for room-sized micro-cells. With clear high-wall line-of-sight, dropping 5 GHz transmit power to Low across all six units gives every room its own clean bubble on a dedicated non-overlapping channel, so phones and laptops roam crisply the moment you walk down the hall.

---

2. The Seven-VLAN Floorplan

To keep firewall logs readable at a glance without doing mental subnet math, every VLAN gets a matching third octet (VLAN 20 = 10.0.20.0/24):

VLAN	Zone	Subnet	DNSDNSDomain Name SystemNetworkingThe distributed hierarchical naming system that translates human-readable hostnames into numerical IP addresses and directs mail routing via MX records. Server	Client Isolation	Who Lives Here
1	Mgmt / Infra	10.0.1.0/24	Local Unbound	Off	UniFi gateway, switches, the 6 U6-IWs, UPSUPSUninterruptible Power SupplyHardwareAn electrical battery backup and surge conditioning apparatus that provides instantaneous emergency power to servers and switches when utility mains power fails., and Proxmox host UI. Zero Wi-Fi.
10	Home	10.0.10.0/24	Local Unbound	Off	Personal laptops, phones, wired desktop PCs, Sonos, Apple TV, printer.
20	Homelab	10.0.20.0/24	Local Unbound	Off	Proxmox LXCsLXCLinux ContainersVirtualizationOS-level virtualization technology providing lightweight, near-bare-metal isolated Linux user spaces using kernel cgroups and namespaces. & VMs: Caddy (*.home-lab.net), Immich, Stalwart mail, GitLab, Home Assistant.
31	Work 1	10.0.31.0/24	1.1.1.1 / 9.9.9.9	On	Remote worker #1 (quarantined internet-only).
32	Work 2	10.0.32.0/24	1.1.1.1 / 9.9.9.9	On	Remote worker #2 (quarantined internet-only).
40	IoTIoTInternet of ThingsHardwareThe collective network of physical devices equipped with sensors, controllers, and network connectivity to transmit telemetry and automate systems.	10.0.40.0/24	1.1.1.1	Off*	Smart TV panels, plugs, sensors, robot vacuums, appliances.
90	Guest	10.0.90.0/24	1.1.1.1	On	Friends & family visiting—with a welcome portal.

*Left off on IoT only where local Matter/HomeKit bridges expect peer-to-peer discovery.

Putting Work Laptops in “Coffee-Shop Jail” (VLAN 31 & VLAN 32)

When two people work remotely from home for different employers, their respective company laptops come pre-installed with corporate endpoint agents whose entire job description is being nosy—passively cataloguing local subnets, gateway MACsMACMedia Access ControlNetworkingThe lower sublayer of the OSI Data Link Layer (Layer 2) that uses globally unique 48-bit hardware MAC addresses to control frame transmission across a shared physical medium., neighbor tables, and DNS replies.

Putting Work 1 and Work 2 on their own separate, isolated VLANs with Client Device Isolation turned on—and handing them plain public DNS (1.1.1.1) instead of my local split-horizon Unbound server—gives both machines the exact network experience of sitting in a Starbucks across town from each other:

• Fast, reliable internet with zero visibility into our personal machines, home servers, or each other’s work equipment.
• Typing home-lab.net on either work laptop resolves innocently to the public AWSAWSAmazon Web ServicesCloudAmazon global cloud computing platform offering on-demand compute, object storage, content delivery, and managed infrastructure services across dozens of geographic regions. CloudFrontCloudFrontAmazon CloudFrontCloudAWS global content delivery network (CDN) that securely delivers data, static assets, and APIs at low latency with edge caching and Origin Access Control. static site, never leaking internal 10.0.20.x homelab addresses into corporate VPNVPNVirtual Private NetworkNetworkingAn encrypted network tunnel that extends a private network across a public network, enabling hosts to send and receive data as if directly connected to the private LAN. telemetry.

Shutting Off the Ceiling-Height Ports (Until Camera Day)

Each U6-IW has a 4-port Ethernet switch built into its bottom edge—including PoE passthrough on Port 1. When your APs are mounted high up on the wall, you obviously aren’t plugging desktop PCs into them unless you want Ethernet cords dangling down the drywall like spiderwebs, but having PoE-capable switch ports already sitting near ceiling height is a huge ace up the sleeve for future PoEPoEPower over EthernetHardwareIEEE 802.3af/at/bt standards that deliver 48–57V DC electrical power alongside data over standard twisted-pair Cat5e/Cat6 Ethernet cabling to power Wi-Fi access points, IP cameras, and VoIP phones. cameras:

• Default All 24 Bottom Ports to Disabled Now, Enable Port 1 Only Where Needed: Using a shared Disabled Ethernet Port Profile in UniFi shuts off Ports 1–4 across all six U6-IWs today (while regular low-wall jacks get VLAN 10, 31, or 32 directly on the central switch). Whenever a camera goes up near an AP later, flipping only Port 1 back on—powered via upstream PoE+ (802.3at) and locked to a zero-internet Cameras / IoT-No-WAN VLAN—powers and isolates the camera over a short patch run without pulling a single new cable back to the rack.
• Smart TVs in IoT, Sonos on Home: Smart TV panels (whose built-in OSes love phoning home with ad telemetry) belong on VLAN 40 (IoT). Sonos speakers and Apple TV, on the other hand, stay on VLAN 10 (Home)—because Sonos’s legacy SSDP discovery opens reverse connections on random high ports back to your phone, and life is far too short to spend Saturday night debugging multicast relays when someone just wants to play music in the kitchen. (Meanwhile, Proxmox sits safely walled off on VLAN 20).

---

3. Dodging “SSID Bloat” While Still Spoiling Guests

When people discover VLANs, the classic mistake is creating one Wi-Fi network name per VLAN.

The problem is Wi-Fi physics: every distinct SSIDSSIDService Set IdentifierNetworkingThe human-readable up-to-32-byte name broadcast in IEEE 802.11 beacon frames that uniquely identifies a Wi-Fi wireless local area network. on a radio has to broadcast management “beacon” frames roughly ten times a second at the slowest legacy data rates. Broadcast six SSIDs across six access points and a surprising share of your airtime goes to access points clearing their throats to announce their own names—while turning everyone’s phone Wi-Fi menu into a discovering Wi-Fi in an airport experience.

By combining band-splitting with UniFi’s Private Pre-Shared Keys (PPSK)—where a single Wi-Fi network name drops devices onto different VLANs depending on which password they type—no radio ever broadcasts more than three SSIDs:

Each SSID has a very specific personality:

• Home (5 GHz · WPA3WPAWi-Fi Protected AccessSecurityThe security certification program developed by the Wi-Fi Alliance to secure wireless computer networks using dynamic key rotation (TKIP) and AES-CCMP/GCMP encryption (WPA2/WPA3).): Fast modern Wi-Fi for phones and laptops—and listed as the trusted SSID in my AlwaysRoute WireGuardWireGuardWireGuard VPN ProtocolSecurityA modern, kernel-resident VPN tunnel protocol using state-of-the-art primitives (ChaCha20-Poly1305, Curve25519) for high-throughput, low-overhead encrypted point-to-point links. On-Demand profile so my phone automatically drops its VPN tunnel the moment I walk through the front door.
• Work (5 GHz · WPA2 PPSK): One SSID, two passwords, two completely air-gapped VLANs—and no captive portal to confuse always-on corporate VPN clients.
• Guest (5 GHz · UniFi Hotspot Portal): Since UniFi’s gateway includes a built-in captive portal, visitors get a clean dark-mode welcome screen (and a polite per-client speed cap so a cousin’s phone backing up 40 GB of vacation videos doesn’t torpedo a call).
• IoT (2.4 GHz only · WPA2, PMF Off, Fast Roaming Off): Because a smart plug from 2021 has the TCP/IPTCP/IPInternet Protocol Suite (TCP/IP)NetworkingThe foundational four-layer suite of communication protocols (Link, Internet, Transport, Application) that powers end-to-end packet routing and transport across the global Internet. stack of a Pop-Tart and suffers a nervous breakdown the moment it sees WPA3 or 5 GHz band steering.

---

4. Teaching Home Assistant to Talk to Toasters (Safely)

Isolating VLANs is easy; letting just enough traffic cross the border without turning your firewall rules into spaghetti is the tricky part. Two patterns keep the rule list tiny:

One-Way Doors Between Home and Homelab

Devices on VLAN 10 (Home) can initiate connections into VLAN 20 (Homelab) on DNS (:53) for local *.home-lab.net resolution and HTTPSHTTPSHypertext Transfer Protocol SecureSecurityAn extension of HTTP that encrypts and authenticates client-server communication over Transport Layer Security (TLS) to prevent eavesdropping and tampering. (:443) for Caddy (which fronts everything behind Authelia passkey login). Return packets flow back via standard Established / Related state—but Homelab cannot initiate new connections into Home. Even if a test container in the lab went sideways, personal laptops and phones sit behind a one-way mirror.

The Two-Legged Proxmox Trick for Home Assistant & IoT

Smart-home protocols (HomeKit, Matter, Chromecast, ESPHome) love shouting across Layer 2 multicast (mDNS) to say “Hello, I am a lightbulb!”—traffic that routers intentionally refuse to forward across VLANs unless you enable mDNS reflectors that leak noisy broadcasts everywhere.

Because Home Assistant will run as a VMVMVirtual MachineVirtualizationA software-emulated or hardware-virtualized computer system that runs an isolated guest operating system and application stack atop a physical hypervisor host. on Proxmox’s VLAN-aware bridge (vmbr0), there is a much cleaner shortcut than fighting multicast routing: give the Home Assistant VM two virtual network cards:

1. net0 on VLAN 20 (Homelab) (with the default gateway): Serves the web UI cleanly behind Caddy and Authelia.
2. net1 on VLAN 40 (IoT) (no gateway): Sits directly on the IoT wire at Layer 2 so Home Assistant hears every bulb, plug, and sensor natively—while those IoT devices still have zero routed path into Homelab or Home.

Pair that with an IoT-No-WAN firewall group that blocks internet access for chatty local sensors and cameras once they’re paired, and the toaster stays strictly in the kitchen where it belongs.

One honest caveat: the two-legged VM makes Home Assistant itself the only bridge between the IoT wire and the lab. That’s the point—but it also means Home Assistant gets patched promptly and doesn’t run anything it doesn’t need.

---

5. Rollout Gameplan

Changing VLANs on a live house network while people are using the internet is an extreme sport, so the rollout order matters:

• Step 1 — Carve Out VLANs & Trunk Proxmox First: Enable VLAN-awareness on Proxmox vmbr0 and verify management reachability on VLAN 1 with a fallback switch port hardcoded to VLAN 10 (the anti-lockout safety rope).
• Step 2 — Bring Up Work (PPSK) & Guest (Hotspot): Test corporate VPN behavior on VLAN 31 / VLAN 32 and style the Guest welcome portal.
• Step 3 — Tune the Six U6-IW Radios: Disable 2.4 GHz on three units, pin Ch 1 / 6 / 11 on the remaining three, and step 5 GHz power down per room while walking the house with WiFiman.
• Step 4 — Lock the Firewall Zones Last: Flip the default inter-VLAN drop rules from Log to Drop only after confirming AirDrop, printing, Caddy HTTPS, and WireGuard On-Demand handoffs all behave cleanly.