I have an EnGenius EAP600 as my access point which allows for up to 8 SSIDs, each of which can be mapped to a different VLAN. It also supports a feature called

I have an EnGenius EAP600 as my access point which allows for up to 8 SSIDs, each of which can be mapped to a different VLAN. It also supports a feature called client isolation, which prevents clients from talking directly to each other. These features make what gvb suggests a little easier. My router is simply a Linux box running Debian (currently a Supermicro SYS-5018A-TN4, previously I had a Soekris net4801, then a Dreamplug). All of my ethernet switches are Netgear SOHO models that support most enterprise features (I use RSTP, VLANs and LACP). I have a couple GS108Ts, a GS716T and a S3300-28X. With these switches I can maintain isolation via VLANs even with multiple switches, and most of the VLANs go into my router via a cheap 10Gbe SFP+ card I got on eBay. Currently, I've got the following "smart" devices: WiFi Scale Smart TV (ethernet) Roku (ethernet) PS3 (ethernet) PS2 (ethernet) Raspberry Pi 2 running OpenELEC (ethernet) None of them are allowed to talk to each other.