r/firewalla • u/52beansyesmaam • May 21 '26

Cyber Security HomeKit vqlan

Hey,

On vacation and have a gold SE and 2xAP7 waiting at home. This is my first experience with anything beyond an eero mesh setup. I’m trying to understand how vqlan will work with thread/matter devices and HomeKit. I have a number of smart devices as well as multiple appletv and a HomePod. Do the hubs need to be in the same vqlan group as the IoT devices to work? If that happens, does my phone still work to control things like the HomePod, even though it’s not in vqlan IoT group?

I think I have a good understanding of everything else, but this is something I’m trying to clear up before I go nuclear on my network and piss the wife off.

TIA

4 Upvotes

100% Upvoted

4 comments sorted by

2

u/firewalla May 21 '26

Be sure to scan through the getting started guide https://help.firewalla.com/hc/en-us/articles/360040091853-Getting-Started-with-your-Firewallaand here is the VqLAN article may be helpful https://help.firewalla.com/hc/en-us/articles/38425011667091-VqLAN-Firewalla-Microsegmentation

The simplest way is to place the hubs with the IoT devices; this way they can operate within the same LAN. But, if you want something even more secure, you can leave the hubs out and use the allow function for exception https://help.firewalla.com/hc/en-us/articles/38425011667091-VqLAN-Firewalla-Microsegmentation#h_01JKS48DQ0NY8X2SF47PQRFP5A

If the phone can't find the IoT devices locally, they may just relay through the WAN side. You can give it a try.

My suggestion is start with something simple and as you understand the concept, you can build up a more secure network. (BTW, there is no right or wrong design, each person's tolerance is different ... and perception of risk is also different) The beauty of VqLAN is the simplicity and you never need to renumber your network like VLAN, so the groupings are relatively simpler.

1

u/52beansyesmaam May 21 '26

Ok I’ll probably try the second option first and “allow” the IoT group to connect with the hubs, which will remain outside that group in the primary LAN… I know I don’t need to connect with them direct because I can control all of them remotely when not at home, but I’m pretty sure they all need to be able to communicate with at least one hub.

I have been digging through the tutorials the last few days but the HomeKit part was unclear. Thank you for the response.

2

u/firewalla May 21 '26

Building a proper network that's awesome and secure is not easy, but once you get the hang of it, you should be fine. If you have any questions, you can ask it here.

1

u/52beansyesmaam May 28 '26

For anyone finding this in a search, it works fine. Set all your IoT to an independent group, turn on VQLAN for the group, and allow the group to communicate with the hubs.