I've got my ISP router (because it needs to decode the fibre-optic), but that's bridged directly into a TP Link C6U router that handles PPPoE. It runs OpenWRT w

I've got my ISP router (because it needs to decode the fibre-optic), but that's bridged directly into a TP Link C6U router that handles PPPoE. It runs OpenWRT with most of the default packages, I've only installed some monitoring/stats graphs and all packages needed to setup DNS over TLS (via Cloudflare). The home network is fully wireless (wiring is pretty old and sockets are in some unfortunate places). There are both 4GHz and 5GHz wifi networks. All my personal devices have static 'leases' to my "dev" subnet, which has no restrictions, port forwarding for certain services, multiple split VPNs with different routes. My significant other has her devices on a "trusted home" subnet (with static leases). All other home devices that may need an internet connection (eg: Homepod), live on a restricted (firewall) subnet (with static leases). Any new device gets leased an IP on a "guest" subnet, that can only communicate on that subnet, and to the internet unrestricted.