Mastering Matter: Seamless Smart Home Integration with Network Segmentation

I’ve been intrigued by the idea of integrating devices with Matter for some time. My smart home setup includes a pair of SwitchBot Hubs, some Govee lights, and an air purifier. Each of these devices comes with its own dedicated app, and while some offer integration with Home Assistant, the process often comes with limitations—such as requiring devices to be connected to the main network.

The primary reason I hadn’t yet migrated these devices to Matter was my desire to maintain network separation for IoT devices, even when using Matter.

Network Segmentation Challenges

Previously, I set up an IoT VLAN where devices on this virtual network are isolated from the main network. Devices like my phone, computer, and Home Assistant server, which are on the main network, can still access the IoT VLAN. However, this setup presented a few hurdles for Matter integration:

1. IPv6 Requirement: I hadn’t enabled IPv6 on the IoT VLAN to reduce the attack surface for potential network threats. Unfortunately, Matter requires IPv6 for communication, so enabling it became a necessity.

2. Local Network Limitation: Home Assistant’s Matter implementation only scans the local network for devices. Since my Home Assistant server resides on the main network, it couldn’t detect Matter devices located on the IoT VLAN.

First Attempt and Challenges

I explored solutions, including this guide on setting up Home Assistant across multiple VLANs. While I managed to connect Matter devices to Home Assistant, this configuration caused my non-Matter devices to become unavailable. Upon inspection, I realized that Home Assistant had designated the IoT VLAN as its default network. This occurred because Home Assistant appears to sort networks by IP subnet, and my IoT VLAN (10.0.15.0/24) was prioritized over my main network (172.16.1.1/24).

Given that the IoT VLAN blocks connections to other networks, this default setting broke many of my integrations. Frustrated, I reset the virtual machine to its previous state and decided to revisit the problem later.

A New Approach

Today, I decided to tackle the issue with a fresh perspective, addressing the shortcomings of my previous setup:

1. Enable IPv6: I ensured that the necessary IPv6 configuration was in place.
2. Maintain Primary Network: I worked to keep the main network as the default for the Home Assistant server.

Here’s how I implemented the solution:

1. Created a New VLAN: I configured a new VLAN with the subnet 172.16.7.1/24, ensuring IPv6 was enabled. Firewall rules were added to block connections from this new VLAN to other networks.
2. Set Up a Wireless Network: A new wireless network was created and assigned to the newly configured VLAN.
3. Updated Proxmox Configuration: In the Proxmox dashboard, I added a new network interface to the Home Assistant VM, connecting it to the new VLAN. After rebooting the VM, Home Assistant automatically detected the new interface, with the main network still designated as the primary one.
4. Specified Matter Network Preferences: Following instructions from this post, I configured the Matter server to prioritize the new network interface. Once this was complete, I moved the Matter-enabled devices to the new network and successfully integrated them with Home Assistant using Matter.

Final Thoughts

This new setup achieves the desired balance between network segmentation and Matter compatibility. By enabling IPv6 and ensuring the main network remains primary, I’ve created a secure and functional environment for my smart devices. Integrating Matter devices is now seamless, without compromising the isolation of my IoT devices.