Vlans firewall rules and something to route between the different networks.

This can all be achieved with pretty much every Linux installation.

This one of those questions I am overwhelmingly eqipped to answer, but only with the weird proprietary knowledge about software defined networking and microsegmentation that my job has endowed me with...

So I'll resist the urge to give you that overcomplicated answer and just say get a firewall like others have suggested.

You’d put a router with firewall capabilities in place of that cloud on the right. The devices you don’t want to have internet access will be put into a different subnet than your normal home LAN on the left. You’ll then make a “Deny all” rule so that the devices on the right can’t leave their subnet, with the exception of any explicit allow rules that you make.

For home, use your firewall. Either physical ports on the firewall with dumb switches or vlans with managed layer 2 switches.

There are many ways to do this. Proxmox can do it with ovs if all your devices are virtualized. Pfsense is probably the most straightforward.

The best way to run pfsense is on dedicated hardware. This would work for you https://protectli.com/vault-4-port/

You'll also then need switches or a managed switch with vlans for each network segment.

I have a similar set-up

I use a wireless access point that can expose multiple ssid with different vlans (I think it a fairly common feature)

my router runs openwrt and the iot vlan is in a different firewall zone

use wireguard to remotely access the lan zone

If you have an AVM Fritz!Box home router you can simply create a new profile that disallows internet access and set the devices you want to "isolate" to that profile. They will be able to access the local network and be accessed by the local network just fine, but they won't have any outgoing (or incoming) connectivity.

Pfsense and opnsense are also very good for this.

Vlan I think. Don't quote me on it

There's already some good answers here, just wanted to share my "solution"

I had a similar problem where I wanted some specific device to not have internet connection but still be on LAN. My lazy ass solution was to manually set the network settings with default gateway set to 0.0.0.0. With IPv6 it would be [::].

But this is not meant to be an advice. You may not even be able to manually set network settings on some of those IoT devices, and removing default gateway from DHCP server is not exactly an elegant solution. Perhaps you could set it to serve different settings based on MAC, but then the other solutions are perhaps simpler and better in some other way.
As I said, this is not an advice.

I know vlans is the answer, but I don't know how to set it up. I really need to do this with my own network some day. There must be an OPNsense guide for this, I know it…

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

5 acronyms in this thread; the most compressed thread commented on today has 13 acronyms.

[Thread #625 for this sub, first seen 24th Mar 2024, 13:45] [FAQ] [Full list] [Contact] [Source code]

Put them all behind a firewall and configure it to block outgoing connections. Then forward the ports you need to the internal machines. Then only something connecting from the outside can talk to them. They won’t be able to initiate a connection.

(Keep in mind, this would also block things like DNS lookups, in case that’s important to you.)

install openwrt on you router.

most routers that arent garbage support it.

What about classic DMZ network and VPN?

The DMZ serves to your LAN only. You use the VPN to effectively become a part of your LAN.

I havent even bothered with it yet but my router has individual settings for internet access for devices. You can even set them in homeassistant. A other idea might be pihole since it works as dns in my home. But that also makes a lot of it absurd because the phone home function on a lot of these is blocked by pihole anyway.

My router's admin console, OOTB, gives me the option to either deny individual devices (based on MAC, etc.) access to the external internet, or create a second (or third, etc.) WiFi network that, itself, is not connected to the outside.

Perhaps you have similar settings?

If you want an OoTB solution you can get a Cloud Gateway from Ubiquiti (the ultra is like $200 I think) and use its vlan feature though you may need another switch.

Otherwise, if you've got unlimited time to tinker, proxmox or pfsense are ok options.

I personally run the UDM SE and I highly recommend this approach if you don't want to roll it yourself.