> Doing this requires a considerable amount of admin work...

As someone who has done this, it's a one-time cost (as long as you're not the sort who simply can't stop tinkering with it and ends up totally rebuilding it like once a quarter (don't ask me how I know)) and -if you have even just a shaky understanding of how to do it- it's not _that_ large of a cost.

> ...and IT knowledge though.

I definitely agree that doing this requires quite a bit of IT knowledge... but it's all stuff that's pretty easily learnable for anyone who's interested in technical stuff and/or technically-inclined.

For folks who are looking to do this on their home LAN, I have some hardware manufacturer recommendations:

All of this VLAN work will be entirely pointless if your switches can't be programmed to enforce the separation, so one will need "managed" switches of some kind. I'd recommend anyone who wants to try to do this to have a look at Mikrotik switches... they are inexpensive and definitely more than good enough for a fancy home LAN.

Mikrotik also sells routers and WiFi APs. I can't comment on the quality, as I have slapped together my own router PC and use OpenWRT Ones for my APs... but I've found their switches to be more than good enough for my fancy home LAN. Perhaps their routers and AP are equally good?

Mikrotik publishes pretty comprehensive documentation here [0]. If you want to dick around with the Mikrotik management CLI for RouterOS -which is their name for their fancy management software- you can install the x86 version of RouterOS in a VM by booting a VM from one of the x86 install images at [1]. They also have a much simpler management software that you can run on all of their switches called "SwOS" -documented here [2]- but that doesn't have any x86 installation media so you can't play with it on your PC.

[0] <https://manual.mikrotik.com/docs/introduction>

[1] <https://mikrotik.com/download?architecture=x86>

[2] <https://manual.mikrotik.com/docs/bridging-and-switching/swos...>