Rebuilding my home network without buying new gear
The network worked, technically. But IoT devices could see my servers, guests joined the same broadcast domain, and every DNS change meant editing three places. A weekend rebuild fixed all of it with hardware I already owned.
VLANs first
Three segments: trusted, devices, and guest. The router does inter-VLAN firewalling with a default-deny between devices and trusted. The smart plugs stopped phoning home to my file server the same day.
DNS layout
# /etc/dnsmasq.d/lan.conf
server=1.1.1.1
local=/lan/
address=/nas.lan/192.168.20.10
address=/git.lan/192.168.20.11One small dnsmasq instance per VLAN upstream of the router resolver. DHCP reservations for everything that matters, and a comment block listing which box owns which address. Boring, documented, done.
Lesson learned: most home network pain is naming and segmentation, not throughput. Nobody needs 10G at home; everybody needs to know which subnet a thing lives on.