I use a TP-Link ER-605 as my main firewall and router. It has five gigabit ethernet ports and one usb port. Ports 2 and 3 can be changed to either wan or lan depending on your setup and if you have more than one internet provider. Or you can leave one wan port and then have four vlans. The way I have my setup is one port being the wan port, one port for my network devices and one untagged vlan for IOT devices so the two networks cannot communicate. Then I have wireless access points on the two different networks. I would soon like to upgrade this to the TP-Link ER-7206 but for now the ER-605 is doing the job.
Click here for pictures.
From the firewall one of the vlans goes to an 8 port linksys switch that I have been using for years. From this switch ethernet cables a run to the different rooms where my servers are located throughout the house. The other vlan goes to a wireless access point because all the IOT devices are wireless and I also have a guess network enabled on that router. In some rooms I have small five port switchs where I have more than one wired device that I need to connect to the network.
Click here for pictures.
So in the settings for this router I have it set to wirless access point so most of the features are disabled including the dhcp server, so the firewall is the only device giving out ip addresses. The AX-3000 handles all the IOT devices on a seperate vlan because it has a much wider signal range so even the wireless cameras on the opposite side of the house gets full signal. This one also has the guess network and cannot reach the network with my servers.
Click here for pictures.
The AX-1800 is just a wireless access point to the network with all my servers just incase I need to connect a laptop that I am repairing so I can access my software folder on the server. Also my phone and all my laptops are connected to this wireless access point.
Click here for pictures.