VLANs. Pretty much everything supports them now other than the crappiest commercial gear. I have: A "front-door" network, which is the network behind my fire

VLANs. Pretty much everything supports them now other than the crappiest commercial gear. I have: A "front-door" network, which is the network behind my firewall. Anything internet facing is there, as well as monitoring tools (e.g. Snort). Things here can't talk back to more interior networks. A "family" network. Generally untrusted, all the phones, iThings, IoT that I decide actually needs to phone home, kids laptops, etc. There's a guest WiFi that dovetails here. A "work" network. Network for my wife and mine work laptops and other work specific resources. A "service" network for all the backend stuff. I have an OpenBSD firewall segregating things. The fileservers are VLAN attached so they have an interface on each network.