Best Hardware Firewalls for Smart Home Security

For most smart homes, the best hardware firewall for smart home security is the SafeHome Plug-n-Play Home Firewall from Marma Security: it is the only pick in this roundup that folds firewall duties, built-in high-speed Wi-Fi rated for roughly 3,000 square feet, and parental controls into a single box, which means a household with 30–80 connected devices gets network-level filtering without buying a separate router, access point, or rack shelf. If your budget is tight and your household has five or fewer regular users, the Zyxel Cyber Security Firewall USGLITE60AX covers the essentials — dual-WAN failover, stateful inspection, and cloud-style management — for a fraction of the cost, provided you already own decent Wi-Fi. If you run a larger property with PoE access points, PoE cameras, guest traffic, or a home lab, the Zyxel USGFLEX500H with its two-year Gold Security Pack is the premium answer, because it powers your edge devices and filters them at the same time. Two further picks matter for specific readers: the Deeper Connect Mini DPN Router for privacy-first routing with a Layer 7 firewall, and the Home Network Security for Homelabs guide for anyone who wants to build a subscription-free OPNsense firewall on their own mini-PC.

Top 3 Picks

Best overall: SafeHome Plug-n-Play Home Firewall (Marma Security)

SafeHome is the pick for the household that wants the firewall to be the network rather than a box bolted onto it. It pairs routing and filtering with built-in high-speed Wi-Fi covering roughly 3,000 square feet and a 4.3 Gbps throughput class, so a typical 1,500–3,500 sq ft home can retire the ISP router and run one appliance that both routes and serves wireless. Parental controls ship on the device instead of as a monthly add-on, which is the single biggest reason it wins on value for families with children.

Best budget: Zyxel Cyber Security Firewall USGLITE60AX

At the budget tier, Zyxel’s USGLITE60AX gives you the two things a small smart home actually needs — dual-WAN failover and proper stateful firewall policy — in a desktop appliance rated for up to five users. It suits a flat or small house where the device count is modest, the ISP router is already in bridge mode or can be, and nobody wants to pay for a security subscription on top of hardware. You supply the Wi-Fi; the firewall supplies the policy.

Best premium: Zyxel USGFLEX500H

The USGFLEX500H is the answer when the network has outgrown consumer gear: a 150-user rating, PoE+ ports that can power access points and cameras directly from the firewall, and a two-year Gold Security Pack bundled up front so the threat-filtering services are already paid for on day one. It is the right pick for a large home, a multi-building property, or a lab where VLAN segmentation and inter-VLAN rules are the point rather than an afterthought.

Also worth a look: the Deeper Connect Mini DPN Router, for readers whose priority is hiding traffic patterns through smart routing and a Layer 7 firewall rather than managing VLANs, and the Home Network Security for Homelabs guide, for readers who would rather build a subscription-free OPNsense firewall themselves and want a structured walkthrough instead of a forum thread.

Quick Comparison

Every product below is compared on the same four axes: how much throughput it can pass, how many devices or users it is positioned to cover, whether its threat filtering runs without an ongoing subscription, and how much networking knowledge the setup demands. Price tiers are given as bands because listing prices move daily.

How We Chose

This roundup is assembled from published product listings, vendor documentation and established networking practice — not from lab testing, and not from owning the hardware. Five criteria did the sorting. First, throughput class versus real-world WAN speed: a firewall is only useful if it can pass your line rate with inspection turned on, so a 4.3 Gbps rated appliance and a 1 Gbps rated router are not interchangeable even if both “work” on a 500 Mbps connection. Second, device and user ceiling: the difference between a 5-user appliance, a 150-user appliance and a plug-and-play box with no published user limit is the difference between a small flat and a home with 90 clients. Third, subscription-free threat filtering: some products filter with local rule sets and blocklists forever, while others bundle premium services for a fixed term and then renew, and that recurring cost belongs in the buying decision. Fourth, setup complexity and category fit: a plug-and-play appliance, a cloud-managed SMB firewall, a decentralized router and a build-it-yourself guide each suit a different level of comfort with DHCP, VLANs and firewall rules. Fifth, upgrade path: whether the product still makes sense after you add cameras, a second access point, a NAS, or a second internet connection.

1. SafeHome Plug-n-Play Home Firewall – Best for typical smart homes

Who it suits

This is the pick for the household that has never opened a router’s advanced settings page and does not want to start. A family home of roughly 1,500–3,500 square feet, 30–80 connected devices across mixed ecosystems (Alexa, Google Home, HomeKit, a couple of Wi-Fi cameras, a robot vacuum, smart plugs, a doorbell), two to five regular users, and at least one child old enough to need content rules — that is the exact profile this product is aimed at. It also suits renters and anyone in an apartment where drilling and rack-mounting is not an option, because a single appliance replaces both the router and the firewall role.

Key specs

• Throughput class: 4.3 Gbps, as stated in the product listing — comfortably above a 1 Gbps fibre line with headroom for LAN-to-LAN traffic
• Wireless: built-in high-speed Wi-Fi, with coverage rated to approximately 3,000 square feet
• Filtering: network-level security plus parental controls with per-profile rules, included rather than sold separately
• Form factor: single plug-and-play appliance that takes over routing duties from an ISP gateway
• Setup: app-guided, no command line, no rack, no separate access point required
• Brand: Marma Security

Strengths

The obvious strength is consolidation. Most smart-home security advice ends with “buy a firewall, then buy a better access point, then figure out which one does DHCP” — SafeHome collapses that into one device and one coverage figure. The 4.3 Gbps rating matters more than it looks: consumer gateways are frequently rated on raw routing throughput and then collapse once you enable content filtering, parental controls and per-device rules. A higher throughput class means the filtering features are less likely to become the bottleneck on a gigabit connection.

The second strength is that parental controls are a first-class feature rather than a paid tier. In practice that means per-person or per-device profiles, scheduled access windows, and category-based blocking applied at the network level, which catches devices that do not support per-app controls — game consoles, smart TVs, and the tablet that somehow still runs an old OS. Network-level filtering is also the only kind that works on devices you cannot install software on.

Pros

• Firewall, routing and Wi-Fi in one appliance — no separate access point, no double NAT if you retire the ISP gateway
• 4.3 Gbps throughput class gives real headroom above a 1 Gbps WAN link
• Coverage rated to roughly 3,000 sq ft, which fits the majority of single-family homes
• Parental controls included, so no separate parental-control subscription
• Plug-and-play onboarding is realistic for a non-technical household

Cons

• Not aimed at readers who want 802.1Q VLANs, inter-VLAN firewall rules and a rack-mounted topology — that is Zyxel and OPNsense territory
• Rated coverage is a single-number estimate; thick walls, foil-backed insulation and a detached garage will still need a mesh node or a second AP
• Because it is an all-in-one, a failure takes out both routing and Wi-Fi at once — keep a spare router or a hotspot plan for outages
• Publishing fewer enterprise-grade spec details means less to compare on paper; you are buying the integrated experience, not a datasheet

How it compares

Against the Zyxel Cyber Security Firewall USGLITE60AX, the trade is money versus convenience. The Zyxel is the cheaper box and it is a purer firewall, but it is wired-only and rated for up to five users, so you still need a Wi-Fi system and you inherit the job of making the two cooperate. SafeHome costs more and gives you less policy granularity, but it arrives as one working network.

Against the Zyxel USGFLEX500H, the trade is scale versus simplicity. The Zyxel handles a 150-user environment, powers PoE devices from its own ports, and expects you to understand VLANs; SafeHome handles a family, powers nothing, and expects you to understand an app. If you are planning cameras on PoE and a separate IoT SSID with its own rules, buy the Zyxel. If you want the whole job done on a Saturday morning, buy SafeHome.

One deployment note that applies either way: put the ISP gateway into bridge mode before installing the new firewall, and if bridge mode is unavailable, put the new firewall in the gateway’s DMZ and disable Wi-Fi on the gateway. Running two NAT layers causes the classic smart-home symptoms — cameras that will not accept a remote connection, game consoles stuck at moderate NAT, and voice assistants that intermittently fail to reach devices.

2. Zyxel Cyber Security Firewall USGLITE60AX – Best for small households on a budget

Who it suits

The USGLITE60AX is for the reader who already has Wi-Fi they are happy with — a decent mesh system or a router in access-point mode — and wants a proper firewall in front of it without spending premium money. It fits a flat or small house with a handful of residents, a moderate device count, and a single internet connection that occasionally drops. It is also a sensible first firewall for someone learning policy rules, because the user ceiling keeps the configuration small enough to reason about.

Key specs

• User rating: up to 5 users, per the product listing — a licence-style ceiling on the number of accounts or clients the appliance is positioned to serve
• WAN: dual-WAN, so a second internet path (a second ISP, a fixed-wireless link, or a cellular gateway) can provide failover or load sharing
• Form factor: compact desktop appliance with wired Gigabit-class ports; no integrated Wi-Fi
• Security: the product name advertises cyber security filtering; the exact service bundle and any renewal terms are worth confirming against the current listing
• Management: browser-based administration with the vendor’s cloud-style management tooling
• Brand: ZYXEL

Strengths

Dual-WAN is the standout feature at this price point, and it is the one that changes daily life. Smart homes are increasingly dependent on the internet for lighting schedules, doorbell notifications and heating control, so a single WAN port is a single point of failure. With dual-WAN you can attach a cheap cellular gateway as a backup path and have the firewall fail over automatically when the primary link drops — a level of resilience that consumer routers at this price almost never provide.

The second strength is that this is a real firewall with real policy, not a parental-control skin. You get inbound and outbound rules, NAT, port forwarding that you control deliberately rather than UPnP opening ports on request, and logging you can actually read. For a smart home, the practical win is being able to say “the camera VLAN may talk to the internet on these ports and nothing else,” which is the single most effective mitigation against the most common smart-home failure mode: a cheap device with an outdated firmware being used as a foothold.

Pros

• Dual-WAN failover is genuinely rare at the budget tier and directly improves smart-home uptime
• Proper stateful firewall policy, NAT control and logging rather than a simplified app
• Low entry cost leaves budget for the Wi-Fi system that actually determines coverage
• Small desktop footprint suits a shelf, a cupboard or a wall bracket near the ONT
• Five-user ceiling is a good match for a couple, a small family, or a single-person flat with a lab

Cons

• No integrated Wi-Fi — you must supply an access point or mesh system and run it in AP mode
• The five-user rating is a hard ceiling in spirit; a large household with many concurrent users should look higher up the range
• Wired port count is limited, so a cheap unmanaged switch may be needed if you have several wired devices
• Security services in this class are often tied to a subscription; confirm what is included and what renews
• Small-business interfaces assume some networking vocabulary — DHCP scopes, subnets, NAT rules — which is a real learning curve

How it compares

Against the SafeHome Plug-n-Play Home Firewall, this is the cheaper, more technical route. SafeHome hands you one integrated network with Wi-Fi and parental controls; the USGLITE60AX hands you policy control and dual-WAN and leaves the wireless problem to you. If your Wi-Fi is already good and your priority is resilience plus rule-based filtering on a budget, the Zyxel wins. If you are replacing everything at once, SafeHome saves a purchase and an afternoon.

Against the Zyxel USGFLEX500H, the difference is scale and power delivery. The 500H is rated for 150 users, includes PoE+ ports and ships with a two-year Gold Security Pack; the USGLITE60AX is rated for five users and powers nothing. For a flat with six to twelve connected devices, the extra capability of the 500H is money spent on capacity you will never use. For a house with cameras, multiple access points and guests, the 500H is the one that will not need replacing in eighteen months.

A practical configuration note for this class of device: reserve addresses for your fixed infrastructure — the access point, the NAS, the cameras and the smart-home hub — and leave the rest of the pool dynamic. Then turn off UPnP and replace any automatic port mappings with explicit, documented rules. That single change removes the most common way smart-home devices quietly expose services to the internet.

3. Zyxel USGFLEX500H – Best for large homes, outbuildings and labs

Who it suits

The USGFLEX500H is aimed at the reader whose network has become infrastructure. That means a large or multi-building property, a home with several PoE access points and PoE security cameras, a household with frequent guests or a home office with staff, or a lab with servers, virtual machines and test VLANs. The 150-user rating and PoE+ ports are the two signals that this is not a family appliance: it is designed to sit at the centre of a network where the firewall also supplies power and policy to the edge devices.

Key specs

• User rating: 150 users, per the product listing — enough headroom for a large household plus guests, staff or lab accounts
• Power over Ethernet: PoE+ ports, which can power compatible access points, cameras and door stations from the firewall itself
• Bundled security: 2 Year Gold Security Pack included, covering the vendor’s premium security service set for a fixed term
• Class: small-business-class firewall with VLAN support, inter-zone policy, VPN endpoints and detailed logging
• Form factor: rack-friendly or shelf-mounted appliance with multiple wired ports
• Brand: ZYXEL

Strengths

PoE+ is the feature that quietly changes a smart-home build. PoE+ delivers up to 30 watts per port (the 802.3at standard; the older 802.3af standard tops out at about 15.4 watts), which is enough for most ceiling access points and the majority of fixed security cameras. Powering those devices from the firewall means no wall warts in a cupboard, no power injectors, and — more importantly — the ability to remotely power-cycle a frozen camera or AP by bouncing the port. If you have ever driven to a property to unplug a camera, that alone justifies the tier.

The second strength is the bundled security term. The Gold Security Pack covers the vendor’s premium filtering services for two years, which means the threat-filtering capability is paid up front rather than appearing as a surprise line item in month two. The honest caveat is that this is a term, not a permanent licence: after two years you either renew or fall back to the firewall’s base rule set. Budget for renewal or plan the migration, and read the bundle contents on the current listing because vendor bundles change.

Pros

• 150-user rating leaves real headroom for guests, staff and lab accounts
• PoE+ ports power access points and cameras directly and allow remote power cycling
• Two-year Gold Security Pack included up front, so premium filtering is not a day-one subscription
• VLAN support and inter-zone policy make proper IoT segmentation possible
• Small-business class logging and VPN capability suit a home office or a multi-site setup

Cons

• Premium price tier — significant overkill for a flat with a dozen devices
• The security pack expires after two years; renewal is a recurring cost you must plan for
• Configuration assumes networking knowledge: zones, VLAN interfaces, policy ordering and NAT rules
• No integrated Wi-Fi, so access points are a separate purchase (even if the firewall can power them)
• PoE budget is finite — see the sizing calculation below before assuming every port can run at full power

How it compares

Against the SafeHome Plug-n-Play Home Firewall, this is a capacity and control upgrade, not a coverage upgrade. SafeHome gives a family one integrated box with Wi-Fi; the 500H gives a technical owner segmentation, PoE and a 150-user ceiling, but leaves the wireless design entirely to them. If you would not enjoy writing inter-VLAN rules, the 500H will frustrate you and SafeHome will not.

Against the Zyxel Cyber Security Firewall USGLITE60AX, it is the same philosophy at ten times the scale: both are wired firewalls with dual-WAN capability and real policy, but only the 500H powers edge devices and supports the device counts that come with cameras, guests and a lab. Choose the LITE for a flat; choose the 500H when you are planning to add access points and cameras in the next two years.

Worked PoE budget: suppose you plan four PoE cameras at roughly 8 watts each (32 W) and two PoE+ access points at roughly 13 watts each (26 W). That is 58 watts of continuous load. Because PoE budgets are shared across all ports and you never want to run the supply at its limit, size the total budget at least 1.5× your calculated load — so you want a PoE budget of roughly 90 watts or more, and you should confirm the per-port ceiling too: 30 W on an 802.3at port versus 15.4 W on an 802.3af port. A camera that needs 20 watts will not run from an af port no matter how much total budget the switch claims.

4. Deeper Connect Mini DPN Router – Best for privacy-first routing

Who it suits

The Deeper Connect Mini suits a different reader than the rest of this list: someone whose primary concern is not segmentation but observation. If your worry is that a smart TV, a doorbell and a voice assistant are all phoning home with usage data, and you want that traffic routed through a decentralized network rather than a single commercial VPN provider, this is the category that addresses it. It also suits travellers and small offices that want a compact always-on gateway with application-aware filtering rather than a full enterprise firewall curriculum.

Key specs

• Throughput class: 1 Gbps, per the product listing — the port and processing ceiling rather than a promise of encrypted throughput
• Processor: ARM64 quad-core, which is the class of chip used for always-on routing and packet inspection at low power
• Firewall: Layer 7 firewall, meaning filtering decisions are made on application and protocol rather than only on IP address and port
• Routing: smart routing, which selects paths across the vendor’s decentralized network rather than a single fixed exit
• Class: compact plug-in gateway with wired Ethernet, positioned as a router addition rather than a full router replacement
• Brand: Deeper Network

Strengths

Layer 7 filtering is the technically interesting part. A traditional firewall rule says “block port 8443 outbound”; a Layer 7 firewall can say “block this application’s traffic regardless of the port it uses,” which matters enormously for smart-home devices, because IoT firmware has a habit of using HTTPS on port 443 for telemetry that is indistinguishable from normal browsing at Layer 4. Application-aware rules let you allow a camera to reach its manufacturer’s update server while blocking its analytics endpoint, if the rule set supports it.

The second strength is the privacy model. Traffic exits through a decentralized network rather than a single provider’s servers, so no single commercial entity holds the complete picture of your household’s traffic patterns. That is a meaningful architectural difference from a conventional VPN. It is also worth being clear-eyed about the trade: an exit node still sees the traffic it carries, so the benefit is distribution rather than encryption magic, and any overlay routing adds latency and reduces effective throughput compared with a direct connection. Treat the 1 Gbps figure as the ceiling on the wire, not a guarantee of tunnel speed.

Pros

• Layer 7, application-aware filtering is more useful against IoT telemetry than port-based rules alone
• Decentralized routing spreads traffic across many exits rather than concentrating it with one provider
• ARM64 quad-core hardware is designed for continuous low-power operation
• Compact form factor suits a desk, a media cabinet or a travel bag
• Smart routing can be applied selectively, so latency-sensitive traffic need not be tunnelled

Cons

• Not a replacement for a full VLAN-capable firewall; there is no equivalent to a 150-user, PoE+, segmented build
• Overlay routing adds latency and reduces effective throughput, and the exit path you get is not something you fully control
• Privacy benefit depends on trust in the network’s node operators, which is a different trust model, not an absence of one
• Effective throughput depends on the peer you exit through at any given moment, so it varies
• 1 Gbps class means it will not keep pace with a multi-gigabit LAN

How it compares

Against the Zyxel USGFLEX500H, the comparison is philosophy rather than price. The Zyxel keeps your traffic on your own connection and gives you the tools to decide precisely which device may talk to which subnet; the Deeper Connect sends selected traffic out through a shared network and filters at the application layer. If your threat model is “I do not want a cheap camera reaching the LAN,” the Zyxel’s segmentation is the stronger tool. If it is “I do not want my ISP and every analytics vendor building a profile of my household,” the Deeper is the more direct answer.

Against the SafeHome Plug-n-Play Home Firewall, the trade is convenience versus anonymity. SafeHome gives one integrated home network with parental controls and no overlay routing to reason about; the Deeper Connect gives privacy-oriented routing and Layer 7 rules but leaves your Wi-Fi exactly as it was. Many readers will end up wanting both, deployed in series — firewall and segmentation first, privacy routing as an optional path for specific devices.

One practical note: because smart-home devices are sensitive to path changes, apply overlay routing selectively rather than to the whole network. Cameras and hubs that re-register with cloud services on every IP change will produce a stream of “device offline” notifications if their egress path shifts constantly.

5. Home Network Security for Homelabs – Best for DIY builders who want no subscriptions

Who it suits

This is the odd one out: it is a book, not an appliance, and it is aimed at the reader who wants to build the firewall rather than buy it. That reader typically has a spare mini-PC or small form factor machine, is comfortable installing an operating system, and objects on principle to paying a yearly subscription for filtering that open-source software can perform. The book covers protecting a home network with OPNsense firewalls, which means the hardware is whatever you supply — and the resulting firewall is genuinely subscription-free, because the software is.

Key specs

• Format: book — no hardware, no licence, no bundled services
• Subject: OPNsense firewalls applied to home network security
• Class: budget tier, and the cheapest way into enterprise-grade routing if you already own suitable hardware
• What you supply: a mini-PC or small form factor machine, ideally with Intel-based Gigabit or 2.5 Gigabit network interfaces
• What you get: a documented path through rules, NAT, VLANs, DNS filtering and VPN configuration
• Brand: n/a (independent guide)

Strengths

The economics are the headline. A commercial firewall with premium filtering typically carries a recurring annual service cost, and over five years that subscription often exceeds the price of the hardware. OPNsense is free and open source, and its filtering stack — DNS blocklists, IP reputation lists, and optional intrusion detection — can be maintained without paying anyone. For a reader who is willing to spend a weekend learning, the total cost of ownership over five years is dramatically lower, and the capability ceiling is higher than most consumer appliances.

The second strength is control. Because you choose the hardware, you choose the network interface count, the CPU, the RAM and the storage. That means you can build exactly the topology you need — a separate interface per VLAN, a dedicated WAN port, a second WAN for failover — rather than accepting the port layout a vendor decided on. It also means you can replace a failed part instead of a whole appliance.

Worked hardware sizing and running cost: for a 1 Gbps WAN with intrusion detection enabled, a common comfortable baseline is a 4-core x86-64 CPU with 8 GB of RAM and a 32 GB SSD; for routing, NAT and firewall rules only, a 2-core machine with 4 GB is generally sufficient at gigabit speeds. Storage should be a small SSD rather than an SD card, because firewall logs and updates write constantly and SD cards fail. On power, a typical mini-PC draws roughly 8–12 W idle and 15–25 W under load; using a 15 W average, the maths is 15 W × 24 h = 360 Wh per day, or 0.36 kWh, which is about 131 kWh per year. At a typical residential rate of roughly $0.15 per kWh, that is about $20 per year to run. Compare that with an annual security subscription in the $80–$150 range and the DIY route can pay for its own hardware within a couple of years.

Pros

• Software is free and open source, so filtering costs nothing per year
• Hardware is your choice — port count, CPU and RAM can match your exact topology
• Running cost is low: roughly $20 per year in electricity for a typical mini-PC
• Capability ceiling is high: full VLANs, inter-VLAN rules, DNS filtering, VPNs and IDS
• You can replace individual parts instead of a sealed appliance

Cons

• It is a book — you must already own or buy a suitable computer, which is the real cost
• Setup complexity is the highest on this list; expect an evening, not twenty minutes
• You are your own support: no vendor hotline when a firmware update breaks something
• No integrated Wi-Fi, so access points and their configuration are a separate task
• Updates and blocklists need periodic attention; an unmaintained firewall is a liability

How it compares

Against the Zyxel USGFLEX500H, this is the difference between renting capability and building it. The 500H gives you PoE, a 150-user rating and a bundled two-year service term with vendor support; the OPNsense route gives you no recurring cost, total hardware freedom and no support contract. If you want to be done in an afternoon and you value a phone number to call, buy the Zyxel. If you enjoy the build and resent subscriptions, buy the book and a used mini-PC.

Against the Zyxel Cyber Security Firewall USGLITE60AX, the honest comparison is five-year cost. The USGLITE60AX is cheaper up front and easier to configure, but any premium filtering attached to it recurs. A second-hand mini-PC plus the guide can land in the same ballpark on day one and then cost almost nothing per year afterwards, at the price of a steeper learning curve and your own maintenance time.

One caveat worth stating plainly: the DIY route is only cheaper if your time is free to you. If an evening of reading firewall rules sounds like a chore rather than a project, the appliance picks above are the better value, because a badly configured DIY firewall is worse than a well-configured plug-and-play one.

How to Choose

Start with your WAN speed and the throughput derating

The most common mistake in buying a home firewall is comparing the headline throughput number to the internet speed and stopping there. Vendors publish raw firewall throughput — routing and NAT only — and separately publish throughput with threat protection enabled, which is usually much lower. Filtering is computationally expensive, and every rule you add costs cycles.

Worked calculation: if you have a 1 Gbps fibre line, do not buy a unit whose filtered throughput is below your line rate if you intend to enable intrusion prevention on all traffic. A practical rule of thumb is to look for a filtered throughput figure of at least 1.5–2× your WAN speed, which leaves headroom for LAN-to-LAN traffic, VPN sessions and simultaneous device activity. Now sanity-check whether you need that speed at all. A realistic smart-home peak looks like this: three 4K streams at roughly 25 Mbps each (75 Mbps), two video calls at roughly 4 Mbps each (8 Mbps), a cloud backup saturating roughly 100 Mbps, and 60 IoT devices at well under 1 Mbps each (say 30 Mbps). That is roughly 215 Mbps of genuine peak demand — under a quarter of a gigabit. The reason to buy headroom is not today’s streaming; it is LAN-to-LAN transfers between a NAS and a workstation, which never touch the WAN and can saturate a 2.5 GbE link on their own.

Count devices, then size your address space

Device count drives three separate decisions: the firewall’s user or client rating, the size of your DHCP pool, and whether you need VLANs at all. A typical modern smart home runs 40–90 clients once you count phones, laptops, tablets, TVs, consoles, cameras, doorbells, speakers, plugs, bulbs, thermostats and the robot vacuum. A single /24 subnet gives you 254 usable addresses, which is plenty — the problem is not running out of addresses, it is that a flat network lets any device reach any other device.

Also check the client ceiling of your Wi-Fi hardware, not just the firewall. Consumer all-in-one routers are commonly cited as comfortable with roughly 30–50 simultaneous