I’ve spent over a decade doing this professionally — Palo Alto, Zscaler, Netskope, Illumio, the whole stack — mostly in enterprise environments with clean topologies, dedicated racks, and someone else worrying about the power bill. So when I decided to bring real visibility into my own home network, I expected it to be a quick weekend project.

It wasn’t. And honestly, that’s exactly why I’m writing this post.

Home networks — and small offices, and shop floors — are messy in a very specific way that enterprise networks aren’t. You don’t get to choose where the ISP terminates. You don’t get to run structured cabling through a wall you’re not allowed to drill. You inherit a topology built for convenience, not security, and then you’re asked to bolt real monitoring onto it without breaking anyone’s Netflix. If you do freelance or consulting work for small offices and retail shops, this is precisely the kind of constraint you’ll run into far more often than a textbook enterprise design.

Here’s how I actually solved it — mistakes, corrections, and all.

The starting point Link to heading

My internet enters the house through a standard ISP-issued gateway (modem + router + Wi-Fi in one box) sitting in my front room. Like a lot of homes, one Wi-Fi radio wasn’t enough to cover the whole place, so at some point I ran a LAN cable to a second router further back in the house, configured with the same Wi-Fi name for seamless roaming. Downstream of that, a managed switch feeds a handful of wired devices — NAS storage, a printer, a couple of always-on boxes.

It’s a completely ordinary setup. Which is exactly the point — most of the networks I’ll ever be asked to secure as a consultant will look more like this than like a textbook enterprise diagram.

I recently added a Sophos XGS series firewall into the mix, purely to see what my network was actually doing — no blocking yet, just log-only visibility as a first step.

Problem one: the firewall couldn’t go where I wanted it to Link to heading

In an ideal world, the firewall sits at the very edge — between the ISP line and everything else — so every byte in or out passes through it. Physically, that wasn’t happening in my house. The firewall lives in the back of the house, nowhere near the ISP router in the front room, and running new structured cabling wasn’t something I wanted to take on for a first pass.

So the real question became: given where the hardware physically has to sit, what’s the most upstream point I can actually reach?

The answer was to run the firewall inline, in transparent bridge mode, on the existing cable between the ISP router and the rest of the house. No re-addressing, no new subnet, no NAT — the firewall just sits invisibly in the path and logs everything crossing it.

[ ISP Router ] ---- [ Firewall: bridge mode ] ---- [ Extension Router ] --- [ Managed Switch ] --- [ Devices ]

This is a deliberately conservative choice for a first deployment. No blocking, no inspection changes — just visibility, on infrastructure that already worked. If you’re doing this for a client, this is a good default posture too: prove you can see the traffic cleanly before you start touching what’s allowed to pass.

Problem two: what happens when the power goes out? Link to heading

This is the one that almost got missed entirely, and it’s a genuinely underrated risk when you’re turning any device into an inline chokepoint — home or commercial. If the firewall loses power and there’s nothing to route traffic in its place, you haven’t added visibility, you’ve added a single point of failure for the whole household’s internet.

My home UPS setup wasn’t rated for the firewall’s power draw, so this wasn’t a hypothetical.

The fix, in my case, was hardware: the Sophos XGS line ships with a dedicated bypass port pair — two physical ports wired to a relay that, on power loss, shorts them together into a dumb wire. No inspection, no logging during that window, but the network stays up. The moment power returns, it drops back into normal inline operation automatically.

Normal operation:      [ ISP Router ] -> [ Firewall inspects + logs ] -> [ Rest of network ]
Power loss (bypass on): [ ISP Router ] ------------ dumb wire -------------> [ Rest of network ]

If you’re speccing out a firewall for a small office or shop, ask this question early: what happens to connectivity on a power blip? Not every device in every price tier has an answer as clean as a hardware bypass pair — it’s worth checking before you commit to a model.

Problem three: the traffic I still couldn’t see Link to heading

Once the bridge was live and logging, I had a good look at what was actually crossing my network — which is a genuinely interesting exercise, by the way. You’ll spot things you didn’t expect: background chatter from apps, devices quietly using third-party DNS instead of your router’s default, and so on.

But there was still a gap. Both Wi-Fi radios in my house — the front-room ISP router and the back-room extension router — sit before the point where I’d inserted the firewall on one side, and were never wired through it on the other. Wi-Fi clients on either radio were invisible to the logs, even though wired devices further downstream were fully covered.

Testing this taught me something worth remembering: you can’t just turn off one radio and assume the other covers the gap. I tried disabling the front-room Wi-Fi, assuming the back-room radio (same SSID) would compensate — it didn’t, and the front rooms lost usable signal. The two radios existed because they were solving two separate, non-overlapping coverage problems. Removing one without replacing it is a mistake I’d genuinely recommend testing for before assuming it’ll be fine, rather than finding out the hard way.

Choosing a fix: dedicated access point vs. mesh Link to heading

Once I understood the constraint properly — front room needs its own radio, and it needs to be wired to the monitored side of the network, not the raw ISP side — I looked at two options:

A wired standalone access point. Best performance, no wireless backhaul overhead, but requires a physical Ethernet run from the back of the house (where the monitored switch lives) to the front room (where coverage is needed). Since I could realistically run that cable, this became the better technical choice — full throughput, no shared radio time, stable and predictable.

A mesh system. Would have avoided the cable entirely — one wired “primary” node feeding the rest of the network, with a wireless “satellite” node in the front room needing nothing but a power socket. Genuinely the right call if running a cable isn’t feasible. It’s a completely valid trade-off, just not the one I needed once cabling was on the table.

I went with a PoE-powered access point from TP-Link’s Omada line — deliberately chosen because my existing managed switch is also Omada-series, which matters for where this is heading next.

[ Managed Switch (back room) ] ---- long Ethernet run ---- [ Access Point (front room) ]
                                                              ↳ replaces ISP router's Wi-Fi

The plan: this access point takes over the front room’s Wi-Fi duties entirely, on the monitored side of the firewall. Once it’s proven to cover the room properly, the ISP router’s own Wi-Fi radio gets switched off — closing the last blind spot without losing any coverage.

What’s next: actual segmentation Link to heading

Visibility was step one. The next phase — once the access point is in and proven — is proper network segmentation, something every small office or shop network should eventually have, not just homes with curious owners:

  • A dedicated family/personal network for everyday devices
  • A separate work/official network for anything client-facing or containing sensitive material
  • An isolated guest Wi-Fi, with zero visibility into anything else on the network

This means moving the firewall from transparent bridge mode into proper routed mode, with each segment as its own VLAN and subnet, explicit firewall rules governing what can (and can’t) talk to what, and access points capable of mapping different Wi-Fi names to different VLANs as traffic enters the network. It’s a meaningfully bigger project than what’s covered here — the managed switch and the access point I’ve chosen both already support this, which was very much a deliberate decision, not an accident.

The takeaway, especially if you’re doing this for someone else’s network Link to heading

None of this was exotic. No enterprise gear, no fiber, no rack. Just a firewall, a switch, a Wi-Fi access point, and a lot of careful thinking about where cables physically go and what happens when something fails.

That’s the actual skill, more often than not — not knowing every feature of a Sophos or Palo Alto box, but being able to look at a messy, real-world topology (a spare bedroom, a shop counter, three floors of an office) and figure out where visibility and control can actually be inserted, given the constraints you’re handed rather than the ones you’d prefer. If you’re a small business or shop owner reading this and wondering whether your own setup could use the same kind of eyes-open review — that’s the exact problem I help people solve.

Next post in this series: building out the VLAN segmentation and what changed once the firewall moved from monitoring to actively enforcing policy.