Loading page
About this tool
Weighted 14-step guide to segmenting cheap smart plugs and bulbs, with a router-aware isolation plan and IoT subnet sizing.
This guide treats budget smart plugs and bulbs as what they are — the least-patched devices on a home network — and scores fourteen weighted controls across segmentation, vendor accounts, local control and end-of-life. It then builds a segmentation plan from what your router can actually do, adds points for Matter, Zigbee or local firmware over cloud-only Wi-Fi, and sizes the IoT subnet from usable IPv4 hosts (2^(32-prefix) - 2) against your device count plus growth. For anyone whose smart-home collection has quietly grown past a dozen devices on one flat network.
Open Smart Plug and Bulb Security Guide on AltFTool — it loads instantly in your browser.
Provide your input — an image, text, or data.
Let the tool analyze or generate the result.
Review, refine, and reuse the output wherever you need it.
Advice differs for a VLAN-capable router, a guest network, or a single flat SSID — no assumption you own enterprise kit.
The protocol you choose determines whether the lights respond when the internet is down; the tool says which.
Usable host counts come from the prefix length, so the recommended range genuinely fits the devices you plan for.
It is the single highest-value control for cheap IoT, because those devices get the fewest firmware updates and are the usual foothold onto a home network. A guest SSID with client isolation gets most of the benefit on ordinary consumer routers; a dedicated VLAN is better if your access point supports it.
Client isolation, sometimes called AP isolation, stops devices on the same wireless network from talking to each other, so a compromised bulb cannot attack the plug beside it. Without it, a guest network only separates IoT devices from your laptops, not from one another.
Only if they support local control. Cloud-dependent Wi-Fi plugs relay every command through a vendor server and stop responding when it is unreachable, while Zigbee, Z-Wave, Matter with a local controller, and devices running Tasmota or ESPHome keep working on the LAN alone.
Size it from usable hosts, which is 2^(32-prefix) minus 2 for the network and broadcast addresses: a /27 gives 30, a /26 gives 62 and a /24 gives 254. Twelve devices with 50% headroom needs 18 addresses, so a /27 fits, but a /26 leaves room for the lighting project you have not started yet.