Create VLAN for home cameras

Question

GOAL: My goal is to create 2 VLANs, 1 for the main network and 1 for the home ip cameras. The two VLANs need to be separated and the devices on different VLANs should not contact each other by any means.

My first thought was to use a switch with VLAN capabilities and the following diagram would represent the network:

Internet - Router - Switch - 2 VLANs

Until now it's all ok. But with these settings, a device landing on VLAN1 can reach out a device on the other VLAN since the packets will go through the router, right?

QUESTION: How can I completely separate the traffic between the 2 VLANs while maintaining remote access to the cameras VLAN? Is it just some ACLs on the router prohibiting the traffic between the 2 VLANs? If yes, am i over-complicating this?

It is possible that i'm missing a lot aspects, I'm really new to this topic. Thanks!

Answer 1

How can I completely separate the traffic between the 2 VLANs while maintaining remote access to the cameras VLAN? Is it just some ACLs on the router prohibiting the traffic between the 2 VLANs? If yes, am i over-complicating this?

Short answer: this is the proper way to set this up. Your router should allow you to set rules as to which host(s) on the main vlan will be allowed to connect to the camera vlan. Will depend on the router/software - most consumer grade routers will not have this functionality but most prosumer (dd-wrt, openwrt) and professional router software (pfSense, etc) will have this capability. You will also need a switch with the capability of running multiple vlans. Again, most consumer grade switches do not, most prosumer or enterprise grade switches do.