If you looked at my network gear and didn't know the backstory, you'd assume I either run a small business out of my house or have a deeply unhealthy relationship with Cisco. Meraki MX67 router. MS120-24P managed switch. MR33 access point. This is not a setup most people arrive at intentionally for a home network.

I didn't buy any of it.

Let me tell you about my VOIP guy.

He's been in the business for over twenty years. Patient, sharp, genuinely one of the good ones in an industry full of people who'll sell you something you don't need and disappear when it breaks. My previous employer, a family business, had been his client for just as long. Two decades of invoices, two decades of trust, and two decades of him treating their network like a personal sandbox for whatever he was currently curious about.

That last part is important.

He's the kind of guy who gets excited about a new protocol at 2pm and has it half-deployed somewhere by 4pm. He needs places to test things. Real environments, real traffic, real edge cases. He sold the business Meraki gear across all four locations: routers, switches, APs, the full stack. For a while, the business network was his lab. He'd call and say "hey, I want to try something with VPN split tunneling, you okay if I mess with it?" And I'd say no, because I was the IT guy there and if it broke it was my problem to fix at whatever hour it decided to fail.

So he needed somewhere else to experiment. And I needed better networking.

The trade wrote itself.

At the time I said no to him using the business network, I was running a family homelab on an Araknis router: one WAN port, nothing fancy, recommended by that same vendor and validated by exactly one Reddit comment from a stranger I'll never meet. It worked. For a while.

The lab kept growing. Unraid was running. tonycore was born. Plex was streaming. Then I discovered Home Assistant, which meant Sonoff switches, Tuya bulbs, a handful of Tasmota devices, some ESPHome nodes — suddenly I had a bunch of cheap WiFi gadgets that I didn't particularly trust on the same network as everything else. The Araknis could handle the traffic. It couldn't handle my paranoia.

Then came the cameras. Four IP cameras, all wired, all needing PoE. The Araknis switch had eight PoE ports. Between Danitza, tonycore, a TV, a PlayStation, and four cameras, I was out of ports. Done. No room to grow.

And somewhere in that same stretch of time, something got into the network. I won't get into the full story here (that one deserves its own post), but let's just say I became very motivated to take network segmentation seriously. That story is coming. It's worse than you're imagining.

I needed VLANs. I needed more ports. I needed a real managed switch. And I needed all of it without spending enterprise hardware money, because I'm not insane.

Enter: my VOIP guy with a proposal.

The deal was simple. He'd bring Meraki gear to the house — MX67, MS120-24P, MR33 — with 5-year licenses already paid. I'd let him use my home network as a test environment for his experiments. VPNs, VOIP configs, routing edge cases, whatever he was working on at the time.

I said yes immediately.

The hardware arrived, we set it up together, and I suddenly had a 24-port managed switch with more PoE than I'd ever need, a proper enterprise router with a real firewall, and a proper AP with SSID-level control. Going from "one flat network and a prayer" to "VLANs and policies" is not a subtle upgrade.

The setup process was not instant. I knew Meraki from work, so the dashboard wasn't new to me. But configuring it for a homelab has different goals than configuring it for an office. The Tasmota and ESPHome devices all needed to move to a dedicated IoT SSID on 2.4GHz. The main SSID runs 5GHz only. The security cameras got their own VLAN, isolated, no internet access, nothing they don't need. Static DHCP reservations for every server and fixed device, managed through the Meraki dashboard instead of on the devices themselves. All my machines have the same IPs you see in Post 1, and none of them are configured locally. Meraki hands them out by MAC address.

Port forwarding needed rethinking too. Before Meraki I wasn't forwarding anything. After the network incident I'd pulled Plex off remote access entirely and kept everything local. Getting that right with the MX67, double-NAT and all, took some time. But I got there.

The IoT VLAN migration was the most tedious part. Every Tasmota device needs its SSID updated individually. ESPHome devices need reflashing or OTA updates with the new credentials. There's no mass migration tool. You just go one device at a time and hope nothing bricks itself halfway through.

Eventually, everything was on the right network, on the right VLAN, with the right access policy. And then I basically stopped touching it.

That's the thing about getting the network right: you don't notice it anymore. Meraki just runs. The dashboard is there when I need it, invisible when I don't. My VOIP guy still calls occasionally when he wants to try something, and I say yes, because the gear is solid enough that his experiments don't worry me, and because it's the least I can do for a guy who handed me a $3,000+ network stack out of a genuine desire to help.

The 5-year licenses will expire eventually. I haven't solved that problem yet. Meraki without an active license is a very expensive paperweight. I'll figure it out when I get there, probably with help from the same guy who got me into this.

That's kind of how it goes with him. He creates situations I'll need to navigate later, and he's also the most likely person to help me navigate them.

Twenty years of that dynamic and counting. Wouldn't change it.

Today the network looks like this: everything critical is on the main LAN with static DHCP reservations. IoT devices (Tasmota, Tuya, ESPHome, anything I don't fully trust) are on their own VLAN with internet access but no lateral movement. Cameras are isolated entirely. Tailscale handles remote access to everything, so nothing meaningful is port-forwarded. The MR33 broadcasts two SSIDs: 5GHz for real devices, 2.4GHz for IoT.

It's also the same Meraki backbone JARVIS relies on for its power-outage failover trick: when the switch drops, JARVIS notices the cable's dead and switches to the ISP modem directly until the batteries recover. None of that works without the network underneath it being right in the first place.

It's not a complex setup by enterprise standards. But by homelab standards, it's exactly right. Everything is where it should be, nothing can talk to anything it shouldn't, and I can reach any machine on the network from anywhere in the world.

For gear I didn't pay for, it's done a lot.