Written 9 Sep 2026. This is a how-to, not a product card.

A VLAN can wait

One house Wi-Fi is enough this weekend. Guest Wi-Fi and a managed switch wait.

Forums love tagged ports. You do not need them to finish the weekend path. SSH and Pi-hole share the house network. That boundary is already keep it on the house network. Don't forward port 22. A café still cannot SSH in: NAT is why SSH stays inside.

What a VLAN is

A way to split one switch into two (or more) networks so junk IoT cannot talk to the leftover box. Useful later, when you have a pile of cheap plugs and a switch that can tag ports. It is not required for ads, a house folder, or couch SSH.

Guest Wi-Fi is not a VLAN

Many house routers already have a guest network. That is a later convenience for visitors. It is not a reason to buy a managed switch tonight. If guest phones still show ads after Pi-hole, that walk is guest Wi-Fi still shows ads. A faster switch is still a later buy: a faster switch.

What next

House boundary: keep SSH inside. First service: house-wide ad block. Write the leftover-box number in Lab plan.

Optional: house Wi-Fi vs guest vs a later VLAN as a sandbox in ByteRush — same Labthrift passkey as Plan. Skip if you just want to keep reading.

Skip

• Skip a managed switch this weekend.
• Skip VLAN 10 / VLAN 20 diagrams tonight.
• Skip putting the leftover box on a guest network so phones cannot reach SSH.