Best way to segment IoT devices on a home network?

I’ve got a pile of smart plugs and a couple of cameras I don’t trust. What’s the cleanest way to keep them off my main LAN without buying a rack full of gear?

A separate VLAN is the standard answer. Put the IoT stuff on its own subnet, block it from initiating connections to your trusted VLAN, and only allow the specific ports your hub needs.

If your router runs OpenWRT or you have a cheap managed switch, VLANs cost nothing. Guest-network isolation is a weaker fallback if your gear can’t do 802.1Q.

Thanks all, going the VLAN route this weekend.