Ubiquiti

No such thing as a stupid question. If you plug in a machine at home, it is behind the router, and behind the router's firewall. If you want more of a firewall locally, something as simple as an EdgeRouter X can get you started easily with this excellent guide: https://github.com/mjp66/Ubiquiti The nice thing about using cloudflare tunnel, is theres zero ports to expose, ever. The cloudflare tunnel app running on your local machine is what connects out to the internet and takes care of creating a secure connection between cloudflare and your machine. If you want to forward more than one port to the machine, you could use something like cloudflare to forward to a machine on your home server, and then have the nginx proxy manager or something send the traffic around internally. It's totally fine to start with cloudflare, and if you aren't

Creating an IoT wifi that is one way is reasonably possible. Someone shared this pdf written by someone that had a nice overview that is transferable to any router. https://github.com/mjp66/Ubiquiti

Another neat idea is to connect all “smart” equipment to an isolated vlan and separate wifi that can still be seen by your normal network devices. For example if your wifi was called “Home”, an additional “Home-IoT” is for every device. The IoT devices can then be set to not sniff your network, or even connect out if you want. A good example of this is in this EdgeRouter setup guide, which is a pretty decent guide on how to plan a home network for more than just basic home browsing. https://github.com/mjp66/Ubiquiti/blob/master/Ubiquiti%20Hom...

One extra step I’ve learned to follow is to verify if needed, could the hardware be permanently redirected to a local server, and worst case reflagged with a different firmware or it can be redirected to remain local. The latter is sometimes easier if it’s a Tuya based device, which a lot of these unknown devices are. https://github.com/make-all/tuya-local One of the main things these “smart” devices do is use your internet connection. It’s wise to create a dedicated _IoT suffixed wifi which can’t access your network or devices, but at the same time your other devices can ping them. How? This is a pretty solid guide of a home network setup here. It can be running a $50 EdgeRouter X or translated to other devices. https://github.com/mjp66/Ubiquiti/blob/master/Ubiquiti%20Hom... Edit: comments below have additional info on Tasmota and ESPH